From 038c64cf9587424e66e46d7497508b98fc82e656 Mon Sep 17 00:00:00 2001
From: yogeshwaran-c <ycyogesh183@gmail.com>
Date: Wed, 29 Apr 2026 15:06:36 +0530
Subject: [PATCH] fix(a11y): add type="button" to native buttons to prevent
 host form submission

Closes #10234

When Swagger UI is mounted inside a host application's <form> element, every
native <button> without an explicit `type` attribute defaults to
`type="submit"`. Clicking the operation expand arrow, the Authorize button,
Execute, Try it out, the Schemas/Models toggle, etc. therefore navigates the
host page or fires the host form's onSubmit handler.

Adds `type="button"` to every interactive native <button> rendered by Swagger
UI that previously omitted the attribute.

Includes:

- Jest unit tests asserting wrapper.find("button").prop("type") === "button"
  on AuthorizeBtn, AuthorizeOperationBtn, Clear, Execute, OperationTag,
  TryItOutButton (Try it out / Cancel / Reset) and ModelCollapse.

- Cypress e2e regression test (test/e2e-cypress/e2e/bugs/10234.cy.js) that
  mounts Swagger UI inside a host <form action="/should-not-submit"> and
  asserts that clicking the tag expand button, opblock summary, opblock
  arrow, "Try it out", and the Schemas/Models toggle all leave the form
  un-submitted (the onsubmit sentinel stays false and the URL pathname
  does not change).
---
 src/core/components/auth/authorize-btn.jsx    |   2 +-
 .../auth/authorize-operation-btn.jsx          |   2 +-
 src/core/components/clear.jsx                 |   2 +-
 src/core/components/execute.jsx               |   2 +-
 src/core/components/operation-summary.jsx     |   4 +-
 src/core/components/operation-tag.jsx         |   2 +-
 src/core/components/try-it-out-button.jsx     |   6 +-
 .../components/model-collapse.jsx             |   2 +-
 .../components/model-example.jsx              |   2 +
 .../json-schema-5/components/models.jsx       |   2 +-
 .../oas31/components/models/models.jsx        |   1 +
 .../request-snippets/request-snippets.jsx     |   2 +-
 .../components/HighlightCode.jsx              |   6 +-
 .../top-bar/components/DarkModeToggle.jsx     |   2 +-
 test/e2e-cypress/e2e/bugs/10234.cy.js         |  54 +++++++
 .../e2e-cypress/static/pages/10234/index.html |  48 ++++++
 test/unit/components/a11y/button-type.jsx     | 141 ++++++++++++++++++
 17 files changed, 265 insertions(+), 15 deletions(-)
 create mode 100644 test/e2e-cypress/e2e/bugs/10234.cy.js
 create mode 100644 test/e2e-cypress/static/pages/10234/index.html
 create mode 100644 test/unit/components/a11y/button-type.jsx

diff --git a/src/core/components/auth/authorize-btn.jsx b/src/core/components/auth/authorize-btn.jsx
index 21b9ba2c0b5..88e30095e4b 100644
--- a/src/core/components/auth/authorize-btn.jsx
+++ b/src/core/components/auth/authorize-btn.jsx
@@ -19,7 +19,7 @@ export default class AuthorizeBtn extends React.Component {
 
     return (
       <div className="auth-wrapper">
-        <button className={isAuthorized ? "btn authorize locked" : "btn authorize unlocked"} onClick={onClick}>
+        <button type="button" className={isAuthorized ? "btn authorize locked" : "btn authorize unlocked"} onClick={onClick}>
           <span>Authorize</span>
           {isAuthorized ? <LockAuthIcon /> : <UnlockAuthIcon />}
         </button>
diff --git a/src/core/components/auth/authorize-operation-btn.jsx b/src/core/components/auth/authorize-operation-btn.jsx
index fcb1fdfd4b7..fdc42ceda01 100644
--- a/src/core/components/auth/authorize-operation-btn.jsx
+++ b/src/core/components/auth/authorize-operation-btn.jsx
@@ -24,7 +24,7 @@ export default class AuthorizeOperationBtn extends React.Component {
     const UnlockAuthOperationIcon = getComponent("UnlockAuthOperationIcon", true)
 
     return (
-      <button className="authorization__btn"
+      <button type="button" className="authorization__btn"
         aria-label={isAuthorized ? "authorization button locked" : "authorization button unlocked"}
         onClick={this.onClick}>
         {isAuthorized ? <LockAuthOperationIcon className="locked" /> : <UnlockAuthOperationIcon className="unlocked"/>}
diff --git a/src/core/components/clear.jsx b/src/core/components/clear.jsx
index d4e0ec859ff..137ccf1e712 100644
--- a/src/core/components/clear.jsx
+++ b/src/core/components/clear.jsx
@@ -11,7 +11,7 @@ export default class Clear extends Component {
 
   render(){
     return (
-      <button className="btn btn-clear opblock-control__btn" onClick={ this.onClick }>
+      <button type="button" className="btn btn-clear opblock-control__btn" onClick={ this.onClick }>
         Clear
       </button>
     )
diff --git a/src/core/components/execute.jsx b/src/core/components/execute.jsx
index e6b3e1b0bed..1123eb64160 100644
--- a/src/core/components/execute.jsx
+++ b/src/core/components/execute.jsx
@@ -95,7 +95,7 @@ export default class Execute extends Component {
   render(){
     const { disabled } = this.props
     return (
-        <button className="btn execute opblock-control__btn" onClick={ this.onClick } disabled={disabled}>
+        <button type="button" className="btn execute opblock-control__btn" onClick={ this.onClick } disabled={disabled}>
           Execute
         </button>
     )
diff --git a/src/core/components/operation-summary.jsx b/src/core/components/operation-summary.jsx
index b90c2981f6a..c5b3c68bfc2 100644
--- a/src/core/components/operation-summary.jsx
+++ b/src/core/components/operation-summary.jsx
@@ -64,7 +64,7 @@ export default class OperationSummary extends PureComponent {
     const allowAnonymous = !hasSecurity || securityIsOptional
     return (
       <div className={`opblock-summary opblock-summary-${method}`} >
-        <button
+        <button type="button"
           aria-expanded={isShown}
           className="opblock-summary-control"
           onClick={toggleShown}
@@ -94,7 +94,7 @@ export default class OperationSummary extends PureComponent {
             />
         }
         <JumpToPath path={specPath} />{/* TODO: use wrapComponents here, swagger-ui doesn't care about jumpToPath */}
-        <button
+        <button type="button"
           aria-label={`${method} ${path.replace(/\//g, "\u200b/")}`}
           className="opblock-control-arrow"
           aria-expanded={isShown}
diff --git a/src/core/components/operation-tag.jsx b/src/core/components/operation-tag.jsx
index fe9124bb4f3..88be778c142 100644
--- a/src/core/components/operation-tag.jsx
+++ b/src/core/components/operation-tag.jsx
@@ -102,7 +102,7 @@ export default class OperationTag extends React.Component {
           }
 
 
-          <button
+          <button type="button"
             aria-expanded={showTag}
             className="expand-operation"
             title={showTag ? "Collapse operation" : "Expand operation"}
diff --git a/src/core/components/try-it-out-button.jsx b/src/core/components/try-it-out-button.jsx
index 176ce314c81..a66d1038bf8 100644
--- a/src/core/components/try-it-out-button.jsx
+++ b/src/core/components/try-it-out-button.jsx
@@ -28,12 +28,12 @@ export default class TryItOutButton extends React.Component {
     return (
       <div className={showReset ? "try-out btn-group" : "try-out"}>
         {
-          enabled ? <button className="btn try-out__btn cancel" onClick={ onCancelClick }>Cancel</button>
-                  : <button className="btn try-out__btn" onClick={ onTryoutClick }>Try it out </button>
+          enabled ? <button type="button" className="btn try-out__btn cancel" onClick={ onCancelClick }>Cancel</button>
+                  : <button type="button" className="btn try-out__btn" onClick={ onTryoutClick }>Try it out </button>
 
         }
         {
-          showReset && <button className="btn try-out__btn reset" onClick={ onResetClick }>Reset</button>
+          showReset && <button type="button" className="btn try-out__btn reset" onClick={ onResetClick }>Reset</button>
         }
       </div>
     )
diff --git a/src/core/plugins/json-schema-5/components/model-collapse.jsx b/src/core/plugins/json-schema-5/components/model-collapse.jsx
index ee0eef73422..cd8ac56d642 100644
--- a/src/core/plugins/json-schema-5/components/model-collapse.jsx
+++ b/src/core/plugins/json-schema-5/components/model-collapse.jsx
@@ -86,7 +86,7 @@ export default class ModelCollapse extends Component {
 
     return (
       <span className={classes || ""} ref={this.onLoad}>
-        <button aria-expanded={this.state.expanded} className="model-box-control" onClick={this.toggleCollapsed}>
+        <button type="button" aria-expanded={this.state.expanded} className="model-box-control" onClick={this.toggleCollapsed}>
           { title && <span className="pointer">{title}</span> }
           <span className={ "model-toggle" + ( this.state.expanded ? "" : " collapsed" ) }></span>
           { !this.state.expanded && <span>{this.state.collapsedContent}</span> }
diff --git a/src/core/plugins/json-schema-5/components/model-example.jsx b/src/core/plugins/json-schema-5/components/model-example.jsx
index 71579cdb770..3d63da3bf15 100644
--- a/src/core/plugins/json-schema-5/components/model-example.jsx
+++ b/src/core/plugins/json-schema-5/components/model-example.jsx
@@ -71,6 +71,7 @@ const ModelExample = ({
           role="presentation"
         >
           <button
+            type="button"
             aria-controls={examplePanelId}
             aria-selected={activeTab === tabs.example}
             className="tablinks"
@@ -88,6 +89,7 @@ const ModelExample = ({
             role="presentation"
           >
             <button
+              type="button"
               aria-controls={modelPanelId}
               aria-selected={activeTab === tabs.model}
               className={cx("tablinks", { inactive: isExecute })}
diff --git a/src/core/plugins/json-schema-5/components/models.jsx b/src/core/plugins/json-schema-5/components/models.jsx
index e9023f36f3e..d6eb9f54d1f 100644
--- a/src/core/plugins/json-schema-5/components/models.jsx
+++ b/src/core/plugins/json-schema-5/components/models.jsx
@@ -63,7 +63,7 @@ export default class Models extends Component {
 
     return <section className={ showModels ? "models is-open" : "models"} ref={this.onLoadModels}>
       <h4>
-        <button
+        <button type="button"
           aria-expanded={showModels}
           className="models-control"
           onClick={() => layoutActions.show(specPathBase, !showModels)}
diff --git a/src/core/plugins/oas31/components/models/models.jsx b/src/core/plugins/oas31/components/models/models.jsx
index 54e9d2b211a..dfd5b9fe4bd 100644
--- a/src/core/plugins/oas31/components/models/models.jsx
+++ b/src/core/plugins/oas31/components/models/models.jsx
@@ -87,6 +87,7 @@ const Models = ({
     >
       <h4>
         <button
+          type="button"
           aria-expanded={isOpen}
           className="models-control"
           onClick={handleModelsExpand}
diff --git a/src/core/plugins/request-snippets/request-snippets.jsx b/src/core/plugins/request-snippets/request-snippets.jsx
index 3fbb127a3bc..2c233720021 100644
--- a/src/core/plugins/request-snippets/request-snippets.jsx
+++ b/src/core/plugins/request-snippets/request-snippets.jsx
@@ -105,7 +105,7 @@ const RequestSnippets = ({ request, requestSnippetsSelectors, getComponent }) =>
           onClick={() => handleSetIsExpanded()}
           style={{ cursor: "pointer" }}
         >Snippets</h4>
-        <button
+        <button type="button"
           onClick={() => handleSetIsExpanded()}
           style={{ border: "none", background: "none" }}
           title={isExpanded ? "Collapse operation" : "Expand operation"}
diff --git a/src/core/plugins/syntax-highlighting/components/HighlightCode.jsx b/src/core/plugins/syntax-highlighting/components/HighlightCode.jsx
index f389f0b95ef..7d66f8d6ab5 100644
--- a/src/core/plugins/syntax-highlighting/components/HighlightCode.jsx
+++ b/src/core/plugins/syntax-highlighting/components/HighlightCode.jsx
@@ -76,7 +76,11 @@ const HighlightCode = ({
       )}
 
       {!downloadable ? null : (
-        <button className="download-contents" onClick={handleDownload}>
+        <button
+          type="button"
+          className="download-contents"
+          onClick={handleDownload}
+        >
           Download
         </button>
       )}
diff --git a/src/standalone/plugins/top-bar/components/DarkModeToggle.jsx b/src/standalone/plugins/top-bar/components/DarkModeToggle.jsx
index 3845fd4ecef..588972fe7d5 100644
--- a/src/standalone/plugins/top-bar/components/DarkModeToggle.jsx
+++ b/src/standalone/plugins/top-bar/components/DarkModeToggle.jsx
@@ -32,7 +32,7 @@ class DarkModeToggle extends Component {
 
     return (
       <div className="dark-mode-toggle">
-        <button onClick={this.toggleIsDarkMode}>
+        <button type="button" onClick={this.toggleIsDarkMode}>
           {!isDarkMode ? (
             <LightBulbOff height="24" />
           ) : (
diff --git a/test/e2e-cypress/e2e/bugs/10234.cy.js b/test/e2e-cypress/e2e/bugs/10234.cy.js
new file mode 100644
index 00000000000..c50245d4a12
--- /dev/null
+++ b/test/e2e-cypress/e2e/bugs/10234.cy.js
@@ -0,0 +1,54 @@
+/**
+ * Regression test for https://github.com/swagger-api/swagger-ui/issues/10234
+ *
+ * When Swagger UI is mounted inside a host application's <form>, clicking any
+ * native <button> rendered by Swagger UI must not trigger form submission.
+ * Native <button> elements default to type="submit", so every interactive
+ * Swagger UI button has to set type="button" explicitly.
+ */
+describe("#10234: native <button> elements default to type=\"button\" when nested in a host <form>", () => {
+  const visitHostFormPage = () => {
+    cy.visit("/pages/10234/")
+    // Allow Swagger UI to finish initializing.
+    cy.window().its("completeCount").should("be.greaterThan", 0)
+    // The flag must start as false; if anything causes a navigation or submit
+    // before we touch a button, this assertion will fail loudly.
+    cy.window().its("__swaggerUiHostFormSubmitted").should("eq", false)
+  }
+
+  const assertHostFormHasNotSubmitted = () => {
+    cy.window().its("__swaggerUiHostFormSubmitted").should("eq", false)
+    cy.location("pathname").should("eq", "/pages/10234/")
+  }
+
+  it("expanding a tag does not submit the host form", () => {
+    visitHostFormPage()
+    cy.get("button.expand-operation").first().click()
+    assertHostFormHasNotSubmitted()
+  })
+
+  it("opening an operation summary does not submit the host form", () => {
+    visitHostFormPage()
+    cy.get("button.opblock-summary-control").first().click()
+    assertHostFormHasNotSubmitted()
+  })
+
+  it("clicking the operation arrow does not submit the host form", () => {
+    visitHostFormPage()
+    cy.get("button.opblock-control-arrow").first().click()
+    assertHostFormHasNotSubmitted()
+  })
+
+  it("clicking 'Try it out' does not submit the host form", () => {
+    visitHostFormPage()
+    cy.get("button.opblock-summary-control").first().click()
+    cy.get("button.try-out__btn").first().click()
+    assertHostFormHasNotSubmitted()
+  })
+
+  it("clicking the Schemas/Models toggle does not submit the host form", () => {
+    visitHostFormPage()
+    cy.get("button.models-control").first().click()
+    assertHostFormHasNotSubmitted()
+  })
+})
diff --git a/test/e2e-cypress/static/pages/10234/index.html b/test/e2e-cypress/static/pages/10234/index.html
new file mode 100644
index 00000000000..16a83330683
--- /dev/null
+++ b/test/e2e-cypress/static/pages/10234/index.html
@@ -0,0 +1,48 @@
+<!-- Regression scenario for https://github.com/swagger-api/swagger-ui/issues/10234 -->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Swagger UI - issue 10234</title>
+  <link rel="stylesheet" type="text/css" href="/swagger-ui.css" >
+  <style>
+    html { box-sizing: border-box; overflow-y: scroll; }
+    *, *:before, *:after { box-sizing: inherit; }
+    body { margin: 0; background: #fafafa; }
+  </style>
+</head>
+
+<body>
+<!--
+  Swagger UI is mounted INSIDE a host <form>. Without type="button" on every
+  native <button>, clicking any of them defaults to type="submit" and triggers
+  navigation to /should-not-submit?... which the test asserts must not happen.
+-->
+<form id="host-form" action="/should-not-submit" method="get" onsubmit="window.__swaggerUiHostFormSubmitted = true; return false;">
+  <div id="swagger-ui"></div>
+  <input type="hidden" name="sentinel" value="please-do-not-submit" />
+</form>
+
+<script src="/swagger-ui-bundle.js" charset="UTF-8"></script>
+<script src="/swagger-ui-standalone-preset.js" charset="UTF-8"></script>
+<script>
+  window.__swaggerUiHostFormSubmitted = false
+  window.onload = function () {
+    window["SwaggerUIBundle"] = window["swagger-ui-bundle"]
+    window["SwaggerUIStandalonePreset"] = window["swagger-ui-standalone-preset"]
+    const ui = SwaggerUIBundle({
+      url: "/documents/petstore-expanded.openapi.yaml",
+      dom_id: "#swagger-ui",
+      presets: [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset],
+      plugins: [SwaggerUIBundle.plugins.DownloadUrl],
+      layout: SwaggerUIStandalonePreset ? "StandaloneLayout" : "BaseLayout",
+      onComplete: function () {
+        window.completeCount = (window.completeCount || 0) + 1
+      }
+    })
+    window.ui = ui
+  }
+</script>
+</body>
+</html>
diff --git a/test/unit/components/a11y/button-type.jsx b/test/unit/components/a11y/button-type.jsx
new file mode 100644
index 00000000000..025cc6fdcaa
--- /dev/null
+++ b/test/unit/components/a11y/button-type.jsx
@@ -0,0 +1,141 @@
+/**
+ * @prettier
+ *
+ * Regression tests for https://github.com/swagger-api/swagger-ui/issues/10234
+ *
+ * When Swagger UI is rendered inside a host application's <form> element, any
+ * native <button> without an explicit `type` attribute defaults to
+ * `type="submit"` and triggers form submission on click. Every interactive
+ * <button> rendered by Swagger UI must therefore set `type="button"`.
+ */
+/* eslint-disable react/jsx-no-bind */
+import React from "react"
+import { shallow } from "enzyme"
+import Im from "immutable"
+
+import AuthorizeBtn from "core/components/auth/authorize-btn"
+import AuthorizeOperationBtn from "core/components/auth/authorize-operation-btn"
+import Clear from "core/components/clear"
+import Execute from "core/components/execute"
+import OperationTag from "core/components/operation-tag"
+import TryItOutButton from "core/components/try-it-out-button"
+import ModelCollapse from "core/plugins/json-schema-5/components/model-collapse"
+
+const noop = () => null
+
+describe('a11y: native <button> elements default to type="button"', function () {
+  it("AuthorizeBtn renders a non-submitting button", function () {
+    const wrapper = shallow(
+      <AuthorizeBtn
+        getComponent={() => noop}
+        onClick={() => {}}
+        isAuthorized={false}
+        showPopup={false}
+      />
+    )
+    expect(wrapper.find("button").prop("type")).toEqual("button")
+  })
+
+  it("AuthorizeOperationBtn renders a non-submitting button", function () {
+    const wrapper = shallow(
+      <AuthorizeOperationBtn
+        getComponent={() => noop}
+        onClick={() => {}}
+        isAuthorized={false}
+      />
+    )
+    expect(wrapper.find("button").prop("type")).toEqual("button")
+  })
+
+  it("Clear renders a non-submitting button", function () {
+    const wrapper = shallow(
+      <Clear
+        specActions={{ clearResponse: () => {}, clearRequest: () => {} }}
+        path="/foo"
+        method="get"
+      />
+    )
+    expect(wrapper.find("button").prop("type")).toEqual("button")
+  })
+
+  it("Execute renders a non-submitting button", function () {
+    const wrapper = shallow(
+      <Execute
+        specSelectors={{
+          validateBeforeExecute: () => true,
+        }}
+        specActions={{
+          validateParams: () => {},
+          execute: () => {},
+          clearValidateParams: () => {},
+        }}
+        operation={Im.Map()}
+        path="/foo"
+        method="get"
+        oas3Selectors={{
+          requestBodyValue: () => null,
+          validateBeforeExecute: () => true,
+          requestContentType: () => null,
+          validateShallowRequired: () => [],
+        }}
+        oas3Actions={{
+          clearRequestBodyValidateError: () => {},
+          setRequestBodyValidateError: () => {},
+        }}
+      />
+    )
+    expect(wrapper.find("button").prop("type")).toEqual("button")
+  })
+
+  it("OperationTag expand button is non-submitting", function () {
+    const wrapper = shallow(
+      <OperationTag
+        tagObj={Im.fromJS({})}
+        tag="pets"
+        oas3Selectors={() => null}
+        layoutSelectors={{
+          currentFilter: () => null,
+          isShown: () => false,
+          show: () => true,
+        }}
+        layoutActions={{ show: () => {} }}
+        getConfigs={() => ({})}
+        getComponent={() => noop}
+        specUrl=""
+      />
+    )
+    expect(wrapper.find("button.expand-operation").prop("type")).toEqual(
+      "button"
+    )
+  })
+
+  it("TryItOutButton 'Try it out' is a non-submitting button", function () {
+    const wrapper = shallow(
+      <TryItOutButton enabled={false} isOAS3 hasUserEditedBody={false} />
+    )
+    expect(wrapper.find("button").prop("type")).toEqual("button")
+  })
+
+  it("TryItOutButton 'Cancel' and 'Reset' are non-submitting buttons", function () {
+    const wrapper = shallow(<TryItOutButton enabled isOAS3 hasUserEditedBody />)
+    const buttons = wrapper.find("button")
+    expect(buttons.length).toEqual(2)
+    buttons.forEach((node) => {
+      expect(node.prop("type")).toEqual("button")
+    })
+  })
+
+  it("ModelCollapse toggle button is non-submitting", function () {
+    const wrapper = shallow(
+      <ModelCollapse
+        layoutSelectors={{ getScrollToKey: () => Im.List() }}
+        specPath={Im.List([])}
+      >
+        <span>contents</span>
+      </ModelCollapse>
+    )
+    expect(wrapper.find("button.model-box-control").prop("type")).toEqual(
+      "button"
+    )
+  })
+})