Skip to content

Commit 0f818a2

Browse files
markstorymarkstory
committedNov 26, 2015
Only allow GET, HEAD, OPTIONS to not have CSRF tokens.
This covers cases where bad guys make up fake HTTP methods to trick CSRF validation. Update test cases to not muck about in $_SERVER too.
·
5.2.0-RC13.1.5
1 parent f7f5e21 commit 0f818a2

File tree

2 files changed

+35
-27
lines changed

2 files changed

+35
-27
lines changed
 

‎src/Controller/Component/CsrfComponent.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ public function startup(Event $event)
9494
if ($request->is('get') && $cookieData === null) {
9595
$this->_setCookie($request, $response);
9696
}
97-
if ($request->is(['patch', 'put', 'post', 'delete'])) {
97+
if (!$request->is(['head', 'get', 'options'])) {
9898
$this->_validateToken($request);
9999
unset($request->data[$this->_config['field']]);
100100
}

‎tests/TestCase/Controller/Component/CsrfComponentTest.php

+34-26
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,11 @@ public function tearDown()
6161
*/
6262
public function testSettingCookie()
6363
{
64-
$_SERVER['REQUEST_METHOD'] = 'GET';
65-
6664
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
67-
$controller->request = new Request(['webroot' => '/dir/']);
65+
$controller->request = new Request([
66+
'environment' => ['REQUEST_METHOD' => 'GET'],
67+
'webroot' => '/dir/',
68+
]);
6869
$controller->response = new Response();
6970

7071
$event = new Event('Controller.startup', $controller);
@@ -87,7 +88,7 @@ public function testSettingCookie()
8788
public static function httpMethodProvider()
8889
{
8990
return [
90-
['PATCH'], ['PUT'], ['POST'], ['DELETE']
91+
['PATCH'], ['PUT'], ['POST'], ['DELETE'], ['PURGE'], ['INVALIDMETHOD']
9192
];
9293
}
9394

@@ -100,11 +101,14 @@ public static function httpMethodProvider()
100101
*/
101102
public function testValidTokenInHeader($method)
102103
{
103-
$_SERVER['REQUEST_METHOD'] = $method;
104-
$_SERVER['HTTP_X_CSRF_TOKEN'] = 'testing123';
105-
106104
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
107-
$controller->request = new Request(['cookies' => ['csrfToken' => 'testing123']]);
105+
$controller->request = new Request([
106+
'environment' => [
107+
'REQUEST_METHOD' => $method,
108+
'HTTP_X_CSRF_TOKEN' => 'testing123',
109+
],
110+
'cookies' => ['csrfToken' => 'testing123']
111+
]);
108112
$controller->response = new Response();
109113

110114
$event = new Event('Controller.startup', $controller);
@@ -122,11 +126,12 @@ public function testValidTokenInHeader($method)
122126
*/
123127
public function testInvalidTokenInHeader($method)
124128
{
125-
$_SERVER['REQUEST_METHOD'] = $method;
126-
$_SERVER['HTTP_X_CSRF_TOKEN'] = 'nope';
127-
128129
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
129130
$controller->request = new Request([
131+
'environment' => [
132+
'REQUEST_METHOD' => $method,
133+
'HTTP_X_CSRF_TOKEN' => 'nope',
134+
],
130135
'cookies' => ['csrfToken' => 'testing123']
131136
]);
132137
$controller->response = new Response();
@@ -144,10 +149,11 @@ public function testInvalidTokenInHeader($method)
144149
*/
145150
public function testValidTokenRequestData($method)
146151
{
147-
$_SERVER['REQUEST_METHOD'] = $method;
148-
149152
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
150153
$controller->request = new Request([
154+
'environment' => [
155+
'REQUEST_METHOD' => $method,
156+
],
151157
'post' => ['_csrfToken' => 'testing123'],
152158
'cookies' => ['csrfToken' => 'testing123']
153159
]);
@@ -168,10 +174,11 @@ public function testValidTokenRequestData($method)
168174
*/
169175
public function testInvalidTokenRequestData($method)
170176
{
171-
$_SERVER['REQUEST_METHOD'] = $method;
172-
173177
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
174178
$controller->request = new Request([
179+
'environment' => [
180+
'REQUEST_METHOD' => $method,
181+
],
175182
'post' => ['_csrfToken' => 'nope'],
176183
'cookies' => ['csrfToken' => 'testing123']
177184
]);
@@ -189,10 +196,11 @@ public function testInvalidTokenRequestData($method)
189196
*/
190197
public function testInvalidTokenRequestDataMissing()
191198
{
192-
$_SERVER['REQUEST_METHOD'] = 'POST';
193-
194199
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
195200
$controller->request = new Request([
201+
'environment' => [
202+
'REQUEST_METHOD' => 'POST',
203+
],
196204
'post' => [],
197205
'cookies' => ['csrfToken' => 'testing123']
198206
]);
@@ -211,10 +219,11 @@ public function testInvalidTokenRequestDataMissing()
211219
*/
212220
public function testInvalidTokenMissingCookie($method)
213221
{
214-
$_SERVER['REQUEST_METHOD'] = $method;
215-
216222
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
217223
$controller->request = new Request([
224+
'environment' => [
225+
'REQUEST_METHOD' => $method
226+
],
218227
'post' => ['_csrfToken' => 'could-be-valid'],
219228
'cookies' => []
220229
]);
@@ -232,10 +241,9 @@ public function testInvalidTokenMissingCookie($method)
232241
*/
233242
public function testCsrfValidationSkipsRequestAction()
234243
{
235-
$_SERVER['REQUEST_METHOD'] = 'POST';
236-
237244
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
238245
$controller->request = new Request([
246+
'environment' => ['REQUEST_METHOD' => 'POST'],
239247
'params' => ['requested' => 1],
240248
'post' => ['_csrfToken' => 'nope'],
241249
'cookies' => ['csrfToken' => 'testing123']
@@ -256,10 +264,11 @@ public function testCsrfValidationSkipsRequestAction()
256264
*/
257265
public function testConfigurationCookieCreate()
258266
{
259-
$_SERVER['REQUEST_METHOD'] = 'GET';
260-
261267
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
262-
$controller->request = new Request(['webroot' => '/dir/']);
268+
$controller->request = new Request([
269+
'environment' => ['REQUEST_METHOD' => 'GET'],
270+
'webroot' => '/dir/'
271+
]);
263272
$controller->response = new Response();
264273

265274
$component = new CsrfComponent($this->registry, [
@@ -290,10 +299,9 @@ public function testConfigurationCookieCreate()
290299
*/
291300
public function testConfigurationValidate()
292301
{
293-
$_SERVER['REQUEST_METHOD'] = 'POST';
294-
295302
$controller = $this->getMock('Cake\Controller\Controller', ['redirect']);
296303
$controller->request = new Request([
304+
'environment' => ['REQUEST_METHOD' => 'POST'],
297305
'cookies' => ['csrfToken' => 'nope', 'token' => 'yes'],
298306
'post' => ['_csrfToken' => 'no match', 'token' => 'yes'],
299307
]);

0 commit comments

Comments
 (0)
Please sign in to comment.