Whitelist form methods in FormRequest.from_response method

scrapy/http/request/form.py

@@ -18,6 +18,7 @@ from scrapy.utils.response import get_base_url
 
 
 class FormRequest(Request):
+    valid_form_methods = ['GET', 'POST', 'DIALOG']
 
     def __init__(self, *args, **kwargs):
         formdata = kwargs.pop('formdata', None)
@@ -48,7 +49,11 @@ class FormRequest(Request):
         form = _get_form(response, formname, formid, formnumber, formxpath)
         formdata = _get_inputs(form, formdata, dont_click, clickdata, response)
         url = _get_form_url(form, kwargs.pop('url', None))
-        method = kwargs.pop('method', form.method)
+
+        method = kwargs.pop('method', form.method).upper()
+        if method not in cls.valid_form_methods:
+            raise ValueError('Invalid form method in chosen form')
+
         return cls(url=url, method=method, formdata=formdata, **kwargs)
 
 

tests/test_http_request.py

@@ -1100,6 +1100,19 @@ class FormRequestTest(RequestTest):
         self.assertRaises(ValueError, self.request_class.from_response,
                           response, formcss="input[name='abc']")
 
+    def test_from_response_valid_form_methods(self):
+        body = """<form action="post.php" method="%s">
+            <input type="hidden" name="one" value="1">
+            </form>"""
+
+        for method in self.request_class.valid_form_methods:
+            response = _buildresponse(body % method)
+            r1 = self.request_class.from_response(response)
+            self.assertEqual(r1.method, method)
+
+        response = _buildresponse(body % 'UNKNOWN')
+        self.assertRaises(ValueError, self.request_class.from_response, response)
+
 
 def _buildresponse(body, **kwargs):
     kwargs.setdefault('body', body)