We want to provide minimal support for forms in Web Lab 2. What we want to support is projects that submit forms via a "submit" button, but all that button does is trigger an event handler that does some benign operation, not write to an external url.

We can support this by allowing forms on the iframe sandbox, but setting form-action to none in the content security policy. This allows submit buttons on forms to work, but you must call preventDefault on that submit action to avoid throwing a content security policy error.

Links

• Jira: AFL-463
• Slack thread

Testing story

Tested locally. Before this a submit button event handler would not work. Now it does, but if you don't call preventDefault you see an error.

PR Creation Checklist:

• Tests provide adequate coverage
• Privacy impacts have been documented
• Security impacts have been documented
• Code is well-commented
• New features are translatable or updates will not break translations
• Relevant documentation has been added or updated
• User impact is well-understood and desirable
• Follow-up work items (including potential tech debt) are tracked and linked