Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[Form] Skip CSRF validation on form when POST max size is exceeded#19373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Conversation

@jameshalsall
Copy link
Contributor

QA
Branch?2.7
Bug fix?yes
New feature?no
BC breaks?no
Deprecations?no
Tests pass?yes
Fixed tickets#19140
LicenseMIT
Doc PRN/A

In#19140 the CSRF validation listener was not aware that the POST max size had exceeded, and was adding a form error message that wasn't relevant to the actual error.

This introduces theServerParams utility class into theCsrfValidationListener and checks that the POST max size has not been exceeded. If it has then it won't bother trying to validate the CSRF token.

My main concern with this change is that it opens up an attack vector around tokens, but I've encapsulated the request size validation in a single method inServerParams now so that the request handlers are using the same logic.

gharlan reacted with heart emoji
@fabpot
Copy link
Member

You should also add the params toFormTypeCsrfExtension and injectform.server_params there so that we have the right ServerParams instance instance of an empty one relying on PHP global vars.

@jameshalsall
Copy link
ContributorAuthor

@fabpot updated

publicfunctionpreSubmit(FormEvent$event)
{
$form =$event->getForm();
$method =$form->getConfig()->getMethod();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This intermediate var can be removed and the code inlined as it's not reused anywhere.

@fabpot
Copy link
Member

👍

{
$contentLength =$this->getContentLength();
$maxContentLength =$this->getPostMaxSize();

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Why is the call toempty() required?

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

If there's no limit set on the max POST size then we can't validate whether or not it has been exceeded.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I mean, we could omit the call toempty() this way:

return$maxContentLength &&$contentLength >$maxContentLength;

HeahDude and yceruto reacted with thumbs up emoji
Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I don't see any benefit in doing that, it just reduces readability in my opinion

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

$maxContentLength isint|null so!empty does not bring any value.

yceruto reacted with thumbs up emoji
Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

If it can be an int or null then empty is entirely useful as it returns true for 0 and null...

yceruto reacted with thumbs down emoji
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I guess you mean the opposite :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I would indeed removeempty. I tried very hard to never useempty and be explicit instead.

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Removed usage ofempty

@jameshalsalljameshalsall changed the titleSkip CSRF validation on form when POST max size is exceeded[Form] Skip CSRF validation on form when POST max size is exceededJul 30, 2016
@fabpot
Copy link
Member

Thank you@jameshalsall.

fabpot added a commit that referenced this pull requestAug 15, 2016
…exceeded (jameshalsall)This PR was squashed before being merged into the 2.7 branch (closes#19373).Discussion----------[Form] Skip CSRF validation on form when POST max size is exceeded| Q             | A| ------------- | ---| Branch?       | 2.7| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets |#19140| License       | MIT| Doc PR        | N/AIn#19140 the CSRF validation listener was not aware that the POST max size had exceeded, and was adding a form error message that wasn't relevant to the actual error.This introduces the `ServerParams` utility class into the `CsrfValidationListener` and checks that the POST max size has not been exceeded. If it has then it won't bother trying to validate the CSRF token.My main concern with this change is that it opens up an attack vector around tokens, but I've encapsulated the request size validation in a single method in `ServerParams` now so that the request handlers are using the same logic.Commits-------289531f [Form] Skip CSRF validation on form when POST max size is exceeded
@fabpotfabpot closed thisAug 15, 2016
This was referencedSep 2, 2016
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@jameshalsall@fabpot@dmaicher@phansys@HeahDude@carsonbot

[8]ページ先頭

©2009-2025 Movatter.jp