Merge pull request #701 from CybercentreCanada/bugfix/formaction-url

Adding regex check that form action is indeed a URL

jsjaws.py

@@ -4435,7 +4435,7 @@ def _hunt_for_suspicious_forms(self, soup: BeautifulSoup) -> None:
                     if not value:
                         continue
                     # https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#attributes_for_form_submission
-                    if key == "action":
+                    if key == "action" and re.match(FULL_URI, value):
                         form_has_action = True
                         if self.single_script_with_unescape:
                             # A form with an action was created from a single script that used an unescape AND the form
@@ -4462,7 +4462,7 @@ def _hunt_for_suspicious_forms(self, soup: BeautifulSoup) -> None:
                                 if not value:
                                     continue
                                 # https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#action
-                                if key == "formaction":
+                                if key == "formaction" and re.match(FULL_URI, value):
                                     form_has_action = True
                                     if self.single_script_with_unescape:
                                         # A form with an action was created from a single script that used an