CSP: Unintended form submit at CommandButton click

[mihaiDumea]

Describe the bug

With CSP enabled, form submit event gets triggered after a commandButton is triggered. Two HTTP requests are generated instead of one.
jsWrapper does not manage to cancel the default action of the event. Maybe the event.cancelable property should be checked only if available, like typeof event.cancelable !== 'boolean' || event.cancelable.

Reproducer

 <h:form>
    <p:commandButton id="cb" action="#{mb.action}" />
    <p:commandButton id="cb2" value="cb2" onclick="$('#cb').click();return false;" type="button" />
 </h:form>

Click on the cb2.

Expected behavior

Generate only one HTTP request(for commandButton).

PrimeFaces edition

No response

PrimeFaces version

11.0.0

Theme

No response

JSF implementation

Mojarra

JSF version

2.2.19

Java version

1.8

Browser(s)

Especially on Chrome

[melloware]

Have you tested a fix?

[mihaiDumea]

Yes I had

[mihaiDumea]

From here I got the inspiration: https://developer.mozilla.org/en-US/docs/Web/API/Event/cancelable

[melloware]

OK check out my PR I think it makes sense.

[mihaiDumea]

Indeed. Without CSP would have an inline event handler onclick="PrimeFaces.ab({...});return false;" and returning false is enough to prevent the default action, either generating the event by the browser and having the event.cancelable defined, or triggering it via JQuery and having event.cancelable undefined.

[melloware]

Thanks for the report and the fix!