335567 - Alternate Content To OBJECT should not participate in HTTP POST

Status: UNCONFIRMED

(Core :: DOM: Core & HTML, defect)

Description

[Vlad Alexander]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

Alternate content such as form controls should not participate in the HTTP POST if the <object> can be rendered. In this example, if logo.gif can be rendered, then data from <textarea> should not be send to the server:

<object data="logo.gif" type="image/gif" width="180" height="60">
	<textarea id="abc" name="abc" rows="5" cols="70">Hello World!</textarea>
</object>

Here is a test case for the above example:
http://misc.xstandard.com/mozilla/alternate-content1.asp

This bug is causing serious problems for us. We produce a Firefox plug-in that uses the following construct:

<object name="abc" type="application/x-xstandard">
	<param name="Value" value="some text" />
	<textarea name="abc">more text</textarea>
</object>

In the above example, data is sent to the server from both our plug-in (correct) and the alternate content (incorrect).

Reproducible: Always

Steps to Reproduce:
1. Create an object element that can be rendered by the browser
2. Add a form element as alternate content to the object element
3. Submit the form

Actual Results:  
Data is sent from the alternate content to the server.

Expected Results:  
No data should be sent to the server from alternate content if the object can be rendered.

Comment 1

[Hixie (not reading bugmail)]

Where does the HTML spec say that such content shouldn't be submitted?

Comment 2

[Vlad Alexander]

I don't think the spec mentions this. But just because this is absent from the spec, it does not make this behaviour correct. Alternate content is replacement for the main object, not an addition to the main object. This also applies not only to HTTP POST, but to scripts as well. The following script should not execute if the object is rendered but it incorrectly does:

<object data="logo.gif" type="image/gif" width="180" height="60">
	<script type="text/javascript">
		alert('Hello');
	</script>
</object>

Comment 3

[Vlad Alexander]

FYI, Opera 9 does not post data from alternate content. And neither does IE.

Comment 4

[Hixie (not reading bugmail)]

Just use different names for the two controls.

Comment 5

[Patrick H. Lauke]

(In reply to comment #4)
> Just use different names for the two controls.

but that's hardly the point, is it? if the object has rendered, the fallback (which is provided as an alternative, in case the object couldn't be rendered) shouldn't submit, imho.

Comment 6

[Hixie (not reading bugmail)]

this is invalid per html5