From: evanm@...
Date: 2004-05-24T22:05:45+09:00
Subject: Buggy form generation with cgi.rb

Hi all,

Using cgi.rb with cgi/session.rb, I found there is improper HTML generated
automatically when using a form with html4:
  
irb(main):001:0> require 'cgi'
=> true
irb(main):002:0> c = CGI.new('html4')
(offline mode: enter name=value pairs on standard input)
=> #<CGI:0x403fa560 @cookies={}, @output_cookies=nil, @multipart=false,
@output_hidden=nil, @params={}>
irb(main):003:0> c.form {}
=> "<FORM METHOD=\"post\"
ENCTYPE=\"application/x-www-form-urlencoded\"></FORM>"
irb(main):004:0> require 'cgi/session'
=> true
irb(main):005:0> s = CGI::Session.new(c)
=> #<CGI::Session:0x403c232c @dbprot=[#<CGI::Session::FileStore:0x403c1d64
@f=#<File:/tmp/37dacbc366cea4c7>, @hash={}>],
@dbman=#<CGI::Session::FileStore:0x403c1d64 @f=#<File:/tmp/37dacbc366cea4c7>,
@hash={}>, @session_id="37dacbc366cea4c7">
irb(main):006:0> c.form {''}
=> "<FORM METHOD=\"post\"       
ENCTYPE=\"application/x-www-form-urlencoded\"><FIELDSET><INPUT TYPE=HIDDEN
NAME=\"_session_id\" VALUE=\"37dacbc366cea4c7\"></FIELDSET></FORM>"

Some folks in #ruby-lang pointed me to this patch which seems cause some of
these issues:
http://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?r1=1.41;r2=1.42

There's several problems here, however:

1) The FIELDSET creates a visible box whenever a form is used.
2) The previous DIV usage is incorrect too, no block container is needed at
all
3) The HIDDEN is not quoted.
4) The entire extra hidden input is useless, as session uses cookies to store
the session ID.

Below are patches to cgi.rb and session.rb. If I am in error and the extra
hidden input is actually used for something, then please at least remove all
DIVs and FIELDSETs from the generated HTML.

--- session.rb.bak      2004-05-24 05:40:52.522375128 -0700
+++ session.rb  2004-05-24 05:46:36.474086520 -0700
@@ -53,7 +53,6 @@
       dbman = option['database_manager'] || FileStore
       @dbman = dbman::new(self, option)
       request.instance_eval do
-       @output_hidden = {session_key => id}
        @output_cookies =  [
           Cookie::new("name" => session_key,
                      "value" => id,


--- cgi.rb.bak  2004-05-24 05:41:28.417918176 -0700
+++ cgi.rb      2004-05-24 05:46:25.491756088 -0700
@@ -1308,16 +1308,6 @@
       else
         body = ""
       end
-      if @output_hidden
-        hidden = @output_hidden.collect{|k,v|
-          "<INPUT TYPE=HIDDEN NAME=\"#{k}\" VALUE=\"#{v}\">"
-        }.to_s
-        if defined? fieldset
-          body += fieldset{ hidden }
-        else
-          body += hidden
-        end
-      end
       super(attributes){body}
     end