Form Submission Validation (form-submission-validation)

Summary

Discovers forms, analyzes structure, tests empty submissions, and checks action endpoint reachability (Playwright).

Classification

• Category: ECOMMERCE
• Plugin id: form-submission-validation
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
contactUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for form-submission-validation.

Check	Typical severity	Why
Form action uses HTTP (absolute action URL not HTTPS)	WARNING	Personal data in contact/inquiry forms would be sent unencrypted.
Form uses GET with >2 fields	INFO	GET puts PII in URLs, logs, and referrer headers — POST is expected for contact forms.
No CAPTCHA or honeypot detected	INFO	Forms without visible anti-spam are prone to automated abuse.
No HTML required / aria-required fields when >1 field	INFO	Missing required attributes allows empty client-side submissions.
Empty submission shows thank-you/success text without validation block	WARNING	Suggests missing server-side validation — spam and junk data may be stored.
Form action URL HEAD request returns ≥500	WARNING	Backend handler errors mean real submissions will fail for customers.

How each check works

1. Load and discover — Opens contactUrl or target URL (networkidle, default 30s), optionally discovers contact page via findContactPageUrl, waits 1.5s.
2. Pick form — Prefers forms whose action/id/class match contact/kontakt/melding patterns; skips search forms; returns passed with score 100 if no form found.
3. Structure checks — Reads method, action, field list, CAPTCHA/honeypot flags. Emits INFO/WARNING findings per rules above (GET threshold >2 fields, required-field threshold >1 field).
4. Empty submit test — Clicks first submit button, waits for navigation/errors 8s + 2s. Blocked if :invalid, error elements, or HTTP ≥400 on navigation response. WARNING if thank-you keywords (thank you, takk, sendt, success, mottatt) appear without block.
5. Action HEAD — For absolute http(s) actions, HEAD with 10s timeout and TesteBot UA; WARNING on 5xx (HEAD failures ignored).
6. Score — 100 − 15 × WARNING count − 5 × INFO count (min 0).

Caveats and concerns

• No successful filled submission — Does not send realistic contact data (avoids spamming customers).
• First matching form — Newsletter signup or search may be analyzed if no contact-specific form exists.
• Relative action URLs — HTTPS inferred from page protocol when action is relative.
• HEAD may fail — Some handlers reject HEAD; 5xx finding only when HEAD succeeds.
• Overlap with contact-form — Both test empty validation; this plugin adds action/method/spam/endpoint checks.

Source

packages/test-plugins/src/plugins/form-submission-validation.ts