Form: POST form checks Http\Request::isSameSite() as CSRF protection

dg · dg · commit 294c833a4897 · 2021-01-11T00:16:49.000+01:00
diff --git a/composer.json b/composer.json
@@ -17,7 +17,7 @@
 	"require": {
 		"php": ">=7.2 <8.1",
 		"nette/component-model": "^3.0",
-		"nette/http": "^3.0",
+		"nette/http": "^3.1",
 		"nette/utils": "^3.2"
 	},
 	"require-dev": {
diff --git a/src/Forms/Form.php b/src/Forms/Form.php
@@ -96,6 +96,9 @@ class Form extends Container implements Nette\HtmlStringable
 	/** @internal @var Nette\Http\IRequest  used only by standalone form */
 	public $httpRequest;
 
+	/** @var bool */
+	protected $crossOrigin = false;
+
 	/** @var mixed or null meaning: not detected yet */
 	private $submittedBy;
 
@@ -214,6 +217,15 @@ public function setHtmlAttribute(string $name, $value = true)
 	}
 
 
+	/**
+	 * Disables CSRF protection using a SameSite cookie.
+	 */
+	public function allowCrossOrigin(): void
+	{
+		$this->crossOrigin = true;
+	}
+
+
 	/**
 	 * Cross-Site Request Forgery (CSRF) form protection.
 	 */
@@ -474,6 +486,9 @@ protected function receiveHttpData(): ?array
 		}
 
 		if ($httpRequest->isMethod('post')) {
+			if (!$this->crossOrigin && !$httpRequest->isSameSite()) {
+				return null;
+			}
 			$data = Nette\Utils\Arrays::mergeTree($httpRequest->getPost(), $httpRequest->getFiles());
 		} else {
 			$data = $httpRequest->getQuery();
@@ -658,6 +673,7 @@ private function getHttpRequest(): Nette\Http\IRequest
 		if (!$this->httpRequest) {
 			$factory = new Nette\Http\RequestFactory;
 			$this->httpRequest = $factory->createHttpRequest();
+			Nette\Http\Helpers::initCookie($this->httpRequest, new Nette\Http\Response);
 		}
 		return $this->httpRequest;
 	}
diff --git a/tests/Forms/Container.values.ArrayHash.phpt b/tests/Forms/Container.values.ArrayHash.phpt
@@ -10,6 +10,7 @@ use Tester\Assert;
 require __DIR__ . '/../bootstrap.php';
 
 
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST = [
 	'title' => 'sent title',
 	'first' => [
diff --git a/tests/Forms/Container.values.array.phpt b/tests/Forms/Container.values.array.phpt
@@ -10,6 +10,7 @@ use Tester\Assert;
 require __DIR__ . '/../bootstrap.php';
 
 
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST = [
 	'title' => 'sent title',
 	'first' => [
diff --git a/tests/Forms/Container.values.mapping.phpt b/tests/Forms/Container.values.mapping.phpt
@@ -50,6 +50,7 @@ function hydrate(string $class, array $data)
 }
 
 
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST = [
 	'title' => 'sent title',
 	'first' => [
diff --git a/tests/Forms/Controls.BaseControl.phpt b/tests/Forms/Controls.BaseControl.phpt
@@ -126,6 +126,7 @@ test('disabled', function () {
 test('disabled & submitted', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = ['disabled' => 'submitted value'];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 	$form = new Form;
 	$form->addText('disabled')
diff --git a/tests/Forms/Controls.Button.loadData.phpt b/tests/Forms/Controls.Button.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.Checkbox.loadData.phpt b/tests/Forms/Controls.Checkbox.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.CheckboxList.loadData.phpt b/tests/Forms/Controls.CheckboxList.loadData.phpt
@@ -18,6 +18,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.ChoiceControl.loadData.phpt b/tests/Forms/Controls.ChoiceControl.loadData.phpt
@@ -22,6 +22,7 @@ class ChoiceControl extends Nette\Forms\Controls\ChoiceControl
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.CsrfProtection.phpt b/tests/Forms/Controls.CsrfProtection.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 
 $form = new Form;
diff --git a/tests/Forms/Controls.HiddenField.loadData.phpt b/tests/Forms/Controls.HiddenField.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.ImageButton.loadData.phpt b/tests/Forms/Controls.ImageButton.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.MultiChoiceControl.loadData.phpt b/tests/Forms/Controls.MultiChoiceControl.loadData.phpt
@@ -23,6 +23,7 @@ class MultiChoiceControl extends Nette\Forms\Controls\MultiChoiceControl
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.MultiSelectBox.loadData.phpt b/tests/Forms/Controls.MultiSelectBox.loadData.phpt
@@ -18,6 +18,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.RadioList.loadData.phpt b/tests/Forms/Controls.RadioList.loadData.phpt
@@ -17,6 +17,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.SelectBox.isOk.phpt b/tests/Forms/Controls.SelectBox.isOk.phpt
@@ -43,6 +43,7 @@ Assert::false($select->isOk());
 
 // error message is processed via Rules
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 Validator::$messages[Nette\Forms\Controls\SelectBox::VALID] = 'SelectBox "%label" must be filled.';
 $form = new Form;
 $form->addSelect('foo', 'Foo', ['bar' => 'Bar']);
diff --git a/tests/Forms/Controls.SelectBox.loadData.phpt b/tests/Forms/Controls.SelectBox.loadData.phpt
@@ -17,6 +17,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.TextBase.loadData.phpt b/tests/Forms/Controls.TextBase.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
 	$_POST = $_FILES = [];
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 });
 
 
diff --git a/tests/Forms/Controls.UploadControl.loadData.phpt b/tests/Forms/Controls.UploadControl.loadData.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 $_FILES = [
 	'avatar' => [
diff --git a/tests/Forms/Forms.callbackParameters.phpt b/tests/Forms/Forms.callbackParameters.phpt
@@ -14,6 +14,7 @@ use Tester\Assert;
 require __DIR__ . '/../bootstrap.php';
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST['text'] = 'a';
 $_POST['btn'] = 'b';
 
diff --git a/tests/Forms/Forms.crossOrigin.phpt b/tests/Forms/Forms.crossOrigin.phpt
@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * Test: Nette\Forms HTTP data.
+ */
+
+declare(strict_types=1);
+
+use Nette\Forms\Form;
+use Tester\Assert;
+
+
+require __DIR__ . '/../bootstrap.php';
+
+
+before(function () {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_GET = $_POST = $_FILES = $_COOKIE = [];
+});
+
+
+test('crossOrigin', function () {
+	$form = new Form;
+	Assert::false($form->isSuccess());
+});
+
+
+test('sameSite', function () {
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
+
+	$form = new Form;
+	Assert::true($form->isSuccess());
+});
+
+
+test('allowed crossOrigin', function () {
+	$form = new Form;
+	$form->allowCrossOrigin();
+	Assert::true($form->isSuccess());
+});
diff --git a/tests/Forms/Forms.getHttpData.post.phpt b/tests/Forms/Forms.getHttpData.post.phpt
@@ -16,6 +16,7 @@ require __DIR__ . '/../bootstrap.php';
 
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_GET = $_POST = $_FILES = [];
 });
 
@@ -31,6 +32,19 @@ test('', function () {
 });
 
 
+test('', function () {
+	unset($_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME]);
+
+	$form = new Form;
+	$form->addSubmit('send', 'Send');
+
+	Assert::false($form->isSubmitted());
+	Assert::false($form->isSuccess());
+	Assert::same([], $form->getHttpData());
+	Assert::same([], $form->getValues(true));
+});
+
+
 test('', function () {
 	$form = new Form;
 	$form->setMethod($form::GET);
diff --git a/tests/Forms/Forms.isValid.phpt b/tests/Forms/Forms.isValid.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_GET = $_POST = $_FILES = [];
 });
 
diff --git a/tests/Forms/Forms.maxPostSize.phpt b/tests/Forms/Forms.maxPostSize.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
 $_SERVER['CONTENT_LENGTH'] = PHP_INT_MAX;
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 $form = new Form;
 $form->addHidden('x');
diff --git a/tests/Forms/Forms.onClick.phpt b/tests/Forms/Forms.onClick.phpt
@@ -12,6 +12,7 @@ require __DIR__ . '/../bootstrap.php';
 
 test('valid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_POST = ['btn' => ''];
 
 	$called = [];
@@ -41,6 +42,7 @@ test('valid', function () {
 
 test('valid -> invalid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_POST = ['btn' => ''];
 
 	$called = [];
@@ -77,6 +79,7 @@ test('valid -> invalid', function () {
 
 test('invalid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_POST = ['btn' => ''];
 
 	$called = [];
diff --git a/tests/Forms/Forms.onSuccess.phpt b/tests/Forms/Forms.onSuccess.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 test('valid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 	$called = [];
 	$form = new Form;
@@ -37,6 +38,7 @@ test('valid', function () {
 
 test('valid -> invalid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 	$called = [];
 	$form = new Form;
@@ -66,6 +68,7 @@ test('valid -> invalid', function () {
 
 test('invalid', function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 	$called = [];
 	$form = new Form;
diff --git a/tests/Forms/Forms.renderer.1.phpt b/tests/Forms/Forms.renderer.1.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST = ['name' => 'John Doe ', 'age' => '', 'email' => '  @ ', 'send' => 'on', 'street' => '', 'city' => '', 'country' => 'HU', 'password' => 'xxx', 'password2' => '', 'note' => '', 'submit1' => 'Send', 'userid' => '231'];
 
 
diff --git a/tests/Forms/Forms.renderer.2.phpt b/tests/Forms/Forms.renderer.2.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 $_POST = ['name' => 'John Doe ', 'age' => '9.9', 'email' => '@', 'street' => '', 'city' => 'Troubsko', 'country' => '0', 'password' => 'xx', 'password2' => 'xx', 'note' => '', 'submit1' => 'Send', 'userid' => '231'];
 
 
diff --git a/tests/Forms/Forms.renderer.3.phpt b/tests/Forms/Forms.renderer.3.phpt
@@ -12,6 +12,7 @@ require __DIR__ . '/../bootstrap.php';
 
 
 $_SERVER['REQUEST_METHOD'] = 'POST';
+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 
 $form = new Nette\Forms\Form;
 $form->addHidden('userid');
diff --git a/tests/Forms/Forms.submittedBy.phpt b/tests/Forms/Forms.submittedBy.phpt
@@ -15,6 +15,7 @@ require __DIR__ . '/../bootstrap.php';
 
 before(function () {
 	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';
 	$_GET = $_POST = $_FILES = [];
 });
 

Original file line number	Diff line number	Diff line change
`@@ -50,6 +50,7 @@ function hydrate(string $class, array $data)`
`50`	`50`	`}`
`51`	`51`
`52`	`52`
	`53`	`+$_COOKIE[Nette\Http\Helpers::STRICT_COOKIE_NAME] = '1';`
`53`	`54`	`$_POST = [`
`54`	`55`	`'title' => 'sent title',`
`55`	`56`	`'first' => [`