Skip to content

[FrameworkBundle] Only enable CSRF protection when enabled in config #9252

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 13 commits into from
Closed

[FrameworkBundle] Only enable CSRF protection when enabled in config #9252

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
3d40f0e
[FrameworkBundle] Only enable CSRF protection when enabled in config
asm89 Oct 9, 2013
d8e2a47
[FrameworkBundle] Csrf configuration + exception if no session
asm89 Oct 9, 2013
4b3e055
[FrameworkBundle] Disable csrf by default (since it depends on session)
asm89 Oct 9, 2013
b5abb04
[FrameworkBundle] Add fixture files
asm89 Oct 9, 2013
8e3be09
[FrameworkBundle] Add csrf_protection configuration to forms
asm89 Oct 10, 2013
8fcd5db
[FrameworkBundle] Test that form csrf needs csrf_protection enabled
asm89 Oct 10, 2013
c836f6d
[FrameworkBundle] Test that csrf_protection can be disabled for forms
asm89 Oct 10, 2013
0a3da81
[FrameworkBundle] Add form csrf-protection attribute to xsd
asm89 Oct 10, 2013
91ea9f7
[FrameworkBundle] security.secure_random is avaible without csrf enabled
asm89 Oct 10, 2013
e842721
[FrameworkBundle] Add csrf field_name option under form
asm89 Oct 10, 2013
3b397e9
[FrameworkBundle] Test csrf field_name precedence + update xsd
asm89 Oct 10, 2013
aabf83c
[FrameworkBundle] Fix docs + remove unneeded check
asm89 Oct 25, 2013
2eb2d89
[FrameworkBundle] Add information about deprecated configuration option
asm89 Oct 25, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ public function getConfigTreeBuilder()
->end()
;

$this->addCsrfSection($rootNode);
$this->addFormSection($rootNode);
$this->addEsiSection($rootNode);
$this->addFragmentsSection($rootNode);
Expand All @@ -93,18 +94,37 @@ public function getConfigTreeBuilder()
return $treeBuilder;
}

private function addCsrfSection(ArrayNodeDefinition $rootNode)
{
$rootNode
->children()
->arrayNode('csrf_protection')
->canBeEnabled()
->children()
->scalarNode('field_name')
->defaultValue('_token')
->info('Deprecated: use form.csrf_protection.field_name instead.')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should add that the setting will be removed in 3.0.

->end()
->end()
->end()
->end()
;
}

private function addFormSection(ArrayNodeDefinition $rootNode)
{
$rootNode
->children()
->arrayNode('form')
->info('form configuration')
->canBeEnabled()
->end()
->arrayNode('csrf_protection')
->canBeDisabled()
->children()
->scalarNode('field_name')->defaultValue('_token')->end()
->arrayNode('csrf_protection')
->canBeDisabled()
->children()
->scalarNode('field_name')->defaultNull()->end()
->end()
->end()
->end()
->end()
->end()
Expand Down
48 changes: 39 additions & 9 deletions src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
class FrameworkExtension extends Extension
{
private $formConfigEnabled = false;
private $sessionConfigEnabled = false;

/**
* Responds to the app.config configuration parameter.
Expand All @@ -56,10 +57,6 @@ public function load(array $configs, ContainerBuilder $container)

$loader->load('debug_prod.xml');

// Enable services for CSRF protection (even without forms)
$loader->load('security.xml');
$loader->load('security_csrf.xml');

if ($container->getParameter('kernel.debug')) {
$loader->load('debug.xml');

Expand Down Expand Up @@ -92,9 +89,14 @@ public function load(array $configs, ContainerBuilder $container)
}

if (isset($config['session'])) {
$this->sessionConfigEnabled = true;
$this->registerSessionConfiguration($config['session'], $container, $loader);
}

$loader->load('security.xml');

$this->registerSecurityCsrfConfiguration($config['csrf_protection'], $container, $loader);

if ($this->isConfigEnabled($container, $config['form'])) {
$this->formConfigEnabled = true;
$this->registerFormConfiguration($config, $container, $loader);
Expand Down Expand Up @@ -158,15 +160,20 @@ public function load(array $configs, ContainerBuilder $container)
private function registerFormConfiguration($config, ContainerBuilder $container, XmlFileLoader $loader)
{
$loader->load('form.xml');
if ($this->isConfigEnabled($container, $config['csrf_protection'])) {
if (!isset($config['session'])) {
throw new \LogicException('CSRF protection needs that sessions are enabled.');
if ($this->isConfigEnabled($container, $config['form']['csrf_protection'])) {
if (!$this->isConfigEnabled($container, $config['csrf_protection'])) {
throw new \LogicException('CSRF protection needs to be enabled in order to use CSRF protection for forms.');
}

$loader->load('form_csrf.xml');

$container->setParameter('form.type_extension.csrf.enabled', true);
$container->setParameter('form.type_extension.csrf.field_name', $config['csrf_protection']['field_name']);

if (null !== $config['form']['csrf_protection']['field_name']) {
$container->setParameter('form.type_extension.csrf.field_name', $config['form']['csrf_protection']['field_name']);
} else {
$container->setParameter('form.type_extension.csrf.field_name', $config['csrf_protection']['field_name']);
}
} else {
$container->setParameter('form.type_extension.csrf.enabled', false);
}
Expand Down Expand Up @@ -696,7 +703,7 @@ private function getValidatorYamlMappingFiles(ContainerBuilder $container)
return $files;
}

private function registerAnnotationsConfiguration(array $config, ContainerBuilder $container,$loader)
private function registerAnnotationsConfiguration(array $config, ContainerBuilder $container, $loader)
{
$loader->load('annotations.xml');

Expand All @@ -722,6 +729,29 @@ private function registerAnnotationsConfiguration(array $config, ContainerBuilde
}
}

/**
* Loads the security configuration.
*
* @param array $config A CSRF configuration array
* @param ContainerBuilder $container A ContainerBuilder instance
* @param XmlFileLoader $loader An XmlFileLoader instance
*
* @throws \LogicException
*/
private function registerSecurityCsrfConfiguration(array $config, ContainerBuilder $container, XmlFileLoader $loader)
{
if (!$this->isConfigEnabled($container, $config)) {
return;
}

if (!$this->sessionConfigEnabled) {
throw new \LogicException('CSRF protection needs sessions to be enabled.');
}

// Enable services for CSRF protection (even without forms)
$loader->load('security_csrf.xml');
}

/**
* Returns the base path for the XSD files.
*
Expand Down
8 changes: 8 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,15 @@
</xsd:complexType>

<xsd:complexType name="form">
<xsd:all>
<xsd:element name="csrf-protection" type="form_csrf_protection" minOccurs="0" maxOccurs="1" />
</xsd:all>
<xsd:attribute name="enabled" type="xsd:boolean" />
</xsd:complexType>

<xsd:complexType name="form_csrf_protection">
<xsd:attribute name="enabled" type="xsd:boolean" />
<xsd:attribute name="field-name" type="xsd:string" />
</xsd:complexType>

<xsd:complexType name="csrf_protection">
Expand Down
10 changes: 8 additions & 2 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,9 +93,15 @@ protected static function getBundleDefaultConfig()
'trusted_proxies' => array(),
'ide' => null,
'default_locale' => 'en',
'form' => array('enabled' => false),
'form' => array(
'enabled' => false,
'csrf_protection' => array(
'enabled' => true,
'field_name' => null,
),
),
'csrf_protection' => array(
'enabled' => true,
'enabled' => false,
'field_name' => '_token',
),
'esi' => array('enabled' => false),
Expand Down
10 changes: 10 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/csrf.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<?php

$container->loadFromExtension('framework', array(
'form' => array(
'enabled' => true,
),
'session' => array(
'handler_id' => null,
),
));
7 changes: 7 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/csrf_disabled.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<?php

$container->loadFromExtension('framework', array(
'csrf_protection' => array(
'enabled' => false,
),
));
7 changes: 7 additions & 0 deletions ...fony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/csrf_needs_session.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<?php

$container->loadFromExtension('framework', array(
'csrf_protection' => array(
'enabled' => true,
),
));
14 changes: 14 additions & 0 deletions ...ndle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/form_csrf_sets_field_name.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
<?php

$container->loadFromExtension('framework', array(
'csrf_protection' => array(
'enabled' => true,
'field_name' => '_custom'
),
'form' => array(
'enabled' => true,
),
'session' => array(
'handler_id' => null,
),
));
17 changes: 17 additions & 0 deletions ...orkBundle/Tests/DependencyInjection/Fixtures/php/form_csrf_under_form_sets_field_name.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<?php

$container->loadFromExtension('framework', array(
'csrf_protection' => array(
'enabled' => true,
'field_name' => '_custom'
),
'form' => array(
'enabled' => true,
'csrf_protection' => array(
'field_name' => '_custom_form'
),
),
'session' => array(
'handler_id' => null,
),
));
8 changes: 8 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/form_no_csrf.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?php

$container->loadFromExtension('framework', array(
'form' => array(
'enabled' => true,
'csrf_protection' => false,
),
));
13 changes: 13 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/csrf.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:form />
<framework:session />
</framework:config>
</container>
12 changes: 12 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/csrf_disabled.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:csrf-protection enabled="false" />
</framework:config>
</container>
12 changes: 12 additions & 0 deletions ...fony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/csrf_needs_session.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:csrf-protection />
</framework:config>
</container>
14 changes: 14 additions & 0 deletions ...ndle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/form_csrf_sets_field_name.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:csrf-protection field-name="_custom" />
<framework:form />
<framework:session />
</framework:config>
</container>
16 changes: 16 additions & 0 deletions ...orkBundle/Tests/DependencyInjection/Fixtures/xml/form_csrf_under_form_sets_field_name.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:csrf-protection field-name="_custom" />
<framework:form>
<framework:csrf-protection field-name="_custom_form" />
</framework:form>
<framework:session />
</framework:config>
</container>
14 changes: 14 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/form_no_csrf.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
<?xml version="1.0" ?>

<container xmlns="http://symfony.com/schema/dic/services"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:framework="http://symfony.com/schema/dic/symfony"
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:form enabled="true">
<framework:csrf-protection enabled="false" />
</framework:form>
</framework:config>
</container>
2 changes: 1 addition & 1 deletion src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/csrf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@ framework:
secret: s3cr3t
form: ~
session: ~
# CSRF should be enabled by default
# CSRF is disabled by default
# csrf_protection: ~
2 changes: 2 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/csrf_disabled.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
framework:
csrf_protection: false
2 changes: 2 additions & 0 deletions ...fony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/csrf_needs_session.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
framework:
csrf_protection: ~
5 changes: 5 additions & 0 deletions ...ndle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/form_csrf_sets_field_name.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
framework:
csrf_protection:
field_name: _custom
form: ~
session: ~
7 changes: 7 additions & 0 deletions ...orkBundle/Tests/DependencyInjection/Fixtures/yml/form_csrf_under_form_sets_field_name.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
framework:
csrf_protection:
field_name: _custom
form:
csrf_protection:
field_name: _custom_form
session: ~
4 changes: 4 additions & 0 deletions src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/form_no_csrf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
framework:
form:
csrf_protection:
enabled: false
Loading