Cutelyst  2.5.0
csrfprotection.cpp
1 /*
2  * Copyright (C) 2017 Matthias Fehring <kontakt@buschmann23.de>
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * This library is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with this library; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 #include "csrfprotection_p.h"
20 
21 #include <Cutelyst/Application>
22 #include <Cutelyst/Engine>
23 #include <Cutelyst/Context>
24 #include <Cutelyst/Request>
25 #include <Cutelyst/Response>
26 #include <Cutelyst/Plugins/Session/Session>
27 #include <Cutelyst/Headers>
28 #include <Cutelyst/Action>
29 #include <Cutelyst/Dispatcher>
30 #include <Cutelyst/Controller>
31 #include <Cutelyst/Upload>
32 
33 #include <QLoggingCategory>
34 #include <QNetworkCookie>
35 #include <QUuid>
36 #include <QUrl>
37 #include <vector>
38 #include <utility>
39 #include <algorithm>
40 
41 #define DEFAULT_COOKIE_AGE Q_INT64_C(31449600) // approx. 1 year
42 #define DEFAULT_COOKIE_NAME "csrftoken"
43 #define DEFAULT_COOKIE_PATH "/"
44 #define DEFAULT_HEADER_NAME "X_CSRFTOKEN"
45 #define DEFAULT_FORM_INPUT_NAME "csrfprotectiontoken"
46 #define CSRF_SECRET_LENGTH 32
47 #define CSRF_TOKEN_LENGTH 2 * CSRF_SECRET_LENGTH
48 #define CSRF_ALLOWED_CHARS "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_"
49 #define CSRF_SESSION_KEY "_csrftoken"
50 #define CONTEXT_CSRF_COOKIE QStringLiteral("_c_csrfcookie")
51 #define CONTEXT_CSRF_COOKIE_USED QStringLiteral("_c_csrfcookieused")
52 #define CONTEXT_CSRF_COOKIE_NEEDS_RESET QStringLiteral("_c_csrfcookieneedsreset")
53 #define CONTEXT_CSRF_PROCESSING_DONE QStringLiteral("_c_csrfprocessingdone")
54 #define CONTEXT_CSRF_COOKIE_SET QStringLiteral("_c_csrfcookieset")
55 #define CONTEXT_CSRF_CHECK_PASSED QStringLiteral("_c_csrfcheckpassed")
56 
57 Q_LOGGING_CATEGORY(C_CSRFPROTECTION, "cutelyst.plugin.csrfprotection", QtWarningMsg)
58 
59 using namespace Cutelyst;
60 
61 static thread_local CSRFProtection *csrf = nullptr;
62 const QRegularExpression CSRFProtectionPrivate::sanitizeRe = QRegularExpression(QStringLiteral("[^a-zA-Z0-9\\-_]"));
63 // Assume that anything not defined as 'safe' by RFC7231 needs protection
64 const QStringList CSRFProtectionPrivate::secureMethods = QStringList({QStringLiteral("GET"), QStringLiteral("HEAD"), QStringLiteral("OPTIONS"), QStringLiteral("TRACE")});
65 
67  , d_ptr(new CSRFProtectionPrivate)
68 {
69 
70 }
71 
73 {
74  delete d_ptr;
75 }
76 
78 {
79  Q_D(CSRFProtection);
80 
81  app->loadTranslations(QStringLiteral("plugin_csrfprotection"));
82 
83  const QVariantMap config = app->engine()->config(QStringLiteral("Cutelyst_CSRFProtection_Plugin"));
84 
85  d->cookieAge = config.value(QStringLiteral("cookie_age"), DEFAULT_COOKIE_AGE).value<qint64>();
86  if (d->cookieAge <= 0) {
87  d->cookieAge = DEFAULT_COOKIE_AGE;
88  }
89  d->cookieDomain = config.value(QStringLiteral("cookie_domain")).toString();
90  if (d->cookieName.isEmpty()) {
91  d->cookieName = QStringLiteral(DEFAULT_COOKIE_NAME);
92  }
93  d->cookiePath = QStringLiteral(DEFAULT_COOKIE_PATH);
94  d->cookieSecure = config.value(QStringLiteral("cookie_secure"), false).toBool();
95  if (d->headerName.isEmpty()) {
96  d->headerName = QStringLiteral(DEFAULT_HEADER_NAME);
97  }
98  d->trustedOrigins = config.value(QStringLiteral("trusted_origins")).toString().split(QLatin1Char(','), QString::SkipEmptyParts);
99  if (d->formInputName.isEmpty()) {
100  d->formInputName = QStringLiteral(DEFAULT_FORM_INPUT_NAME);
101  }
102  d->logFailedIp = config.value(QStringLiteral("log_failed_ip"), false).toBool();
103  if (d->errorMsgStashKey.isEmpty()) {
104  d->errorMsgStashKey = QStringLiteral("error_msg");
105  }
106 
107  connect(app, &Application::postForked, this, [](Application *app){
108  csrf = app->plugin<CSRFProtection *>();
109  });
110 
111  connect(app, &Application::beforeDispatch, this, [d](Context *c) {
112  d->beforeDispatch(c);
113  });
114 
115  return true;
116 }
117 
118 void CSRFProtection::setDefaultDetachTo(const QString &actionNameOrPath)
119 {
120  Q_D(CSRFProtection);
121  d->defaultDetachTo = actionNameOrPath;
122 }
123 
124 void CSRFProtection::setFormFieldName(const QString &fieldName)
125 {
126  Q_D(CSRFProtection);
127  if (!fieldName.isEmpty()) {
128  d->formInputName = fieldName;
129  } else {
130  d->formInputName = QStringLiteral(DEFAULT_FORM_INPUT_NAME);
131  }
132 }
133 
134 void CSRFProtection::setErrorMsgStashKey(const QString &keyName)
135 {
136  Q_D(CSRFProtection);
137  if (!keyName.isEmpty()) {
138  d->errorMsgStashKey = keyName;
139  } else {
140  d->errorMsgStashKey = QStringLiteral("error_msg");
141  }
142 }
143 
144 void CSRFProtection::setIgnoredNamespaces(const QStringList &namespaces)
145 {
146  Q_D(CSRFProtection);
147  d->ignoredNamespaces = namespaces;
148 }
149 
150 void CSRFProtection::setUseSessions(bool useSessions)
151 {
152  Q_D(CSRFProtection);
153  d->useSessions = useSessions;
154 }
155 
157 {
158  Q_D(CSRFProtection);
159  d->cookieHttpOnly = httpOnly;
160 }
161 
162 void CSRFProtection::setCookieName(const QString &cookieName)
163 {
164  Q_D(CSRFProtection);
165  d->cookieName = cookieName;
166 }
167 
168 void CSRFProtection::setHeaderName(const QString &headerName)
169 {
170  Q_D(CSRFProtection);
171  d->headerName = headerName;
172 }
173 
174 void CSRFProtection::setGenericErrorMessage(const QString &message)
175 {
176  Q_D(CSRFProtection);
177  d->genericErrorMessage = message;
178 }
179 
181 {
182  Q_D(CSRFProtection);
183  d->genericContentType = type;
184 }
185 
187 {
188  QByteArray token;
189 
190  const QByteArray contextCookie = c->stash(CONTEXT_CSRF_COOKIE).toByteArray();
191  QByteArray secret;
192  if (contextCookie.isEmpty()) {
193  secret = CSRFProtectionPrivate::getNewCsrfString();
194  token = CSRFProtectionPrivate::saltCipherSecret(secret);
195  c->setStash(CONTEXT_CSRF_COOKIE, token);
196  } else {
197  secret = CSRFProtectionPrivate::unsaltCipherToken(contextCookie);
198  token = CSRFProtectionPrivate::saltCipherSecret(secret);
199  }
200 
201  c->setStash(CONTEXT_CSRF_COOKIE_USED, true);
202 
203  return token;
204 }
205 
207 {
208  QString form;
209 
210  if (!csrf) {
211  qCCritical(C_CSRFPROTECTION) << "CSRFProtection plugin not registered";
212  return form;
213  }
214 
215  form = QStringLiteral("<input type=\"hidden\" name=\"%1\" value=\"%2\">").arg(csrf->d_ptr->formInputName, QString::fromLatin1(CSRFProtection::getToken(c)));
216 
217  return form;
218 }
219 
221 {
222  if (CSRFProtectionPrivate::secureMethods.contains(c->req()->method())) {
223  return true;
224  } else {
225  return c->stash(CONTEXT_CSRF_CHECK_PASSED).toBool();
226  }
227 }
228 
229 //void CSRFProtection::rotateToken(Context *c)
230 //{
231 // c->setStash(CONTEXT_CSRF_COOKIE_USED, true);
232 // c->setStash(CONTEXT_CSRF_COOKIE, CSRFProtectionPrivate::getNewCsrfToken());
233 // c->setStash(CONTEXT_CSRF_COOKIE_NEEDS_RESET, true);
234 //}
235 
240 QByteArray CSRFProtectionPrivate::getNewCsrfString()
241 {
242  QByteArray csrfString;
243 
244  while (csrfString.size() < CSRF_SECRET_LENGTH) {
245  csrfString.append(QUuid::createUuid().toRfc4122().toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals));
246  }
247 
248  csrfString.resize(CSRF_SECRET_LENGTH);
249 
250  return csrfString;
251 }
252 
258 QByteArray CSRFProtectionPrivate::saltCipherSecret(const QByteArray &secret)
259 {
260  QByteArray salted;
261  salted.reserve(CSRF_TOKEN_LENGTH);
262 
263  const QByteArray salt = CSRFProtectionPrivate::getNewCsrfString();
264  const QByteArray chars = QByteArrayLiteral(CSRF_ALLOWED_CHARS);
265  std::vector<std::pair<int,int>> pairs;
266  pairs.reserve(std::min(secret.size(), salt.size()));
267  for (int i = 0; i < std::min(secret.size(), salt.size()); ++i) {
268  pairs.push_back(std::make_pair(chars.indexOf(secret.at(i)), chars.indexOf(salt.at(i))));
269  }
270 
271  QByteArray cipher;
272  cipher.reserve(CSRF_SECRET_LENGTH);
273  for (std::size_t i = 0; i < pairs.size(); ++i) {
274  const std::pair<int,int> p = pairs.at(i);
275  cipher.append(chars[(p.first + p.second) % chars.size()]);
276  }
277 
278  salted = salt + cipher;
279 
280  return salted;
281 }
282 
289 QByteArray CSRFProtectionPrivate::unsaltCipherToken(const QByteArray &token)
290 {
291  QByteArray secret;
292  secret.reserve(CSRF_SECRET_LENGTH);
293 
294  const QByteArray salt = token.left(CSRF_SECRET_LENGTH);
295  const QByteArray _token = token.mid(CSRF_SECRET_LENGTH);
296 
297  const QByteArray chars = QByteArrayLiteral(CSRF_ALLOWED_CHARS);
298  std::vector<std::pair<int,int>> pairs;
299  pairs.reserve(std::min(salt.size(), _token.size()));
300  for (int i = 0; i < std::min(salt.size(), _token.size()); ++i) {
301  pairs.push_back(std::make_pair(chars.indexOf(_token.at(i)), chars.indexOf(salt.at(i))));
302  }
303 
304 
305  for (std::size_t i = 0; i < pairs.size(); ++i) {
306  const std::pair<int,int> p = pairs.at(i);
307  int idx = p.first - p.second;
308  if (idx < 0) {
309  idx = chars.size() + idx;
310  }
311  secret.append(chars.at(idx));
312  }
313 
314  return secret;
315 }
316 
322 QByteArray CSRFProtectionPrivate::getNewCsrfToken()
323 {
324  return CSRFProtectionPrivate::saltCipherSecret(CSRFProtectionPrivate::getNewCsrfString());
325 }
326 
332 QByteArray CSRFProtectionPrivate::sanitizeToken(const QByteArray &token)
333 {
334  QByteArray sanitized;
335 
336  const QString tokenString = QString::fromLatin1(token);
337  if (tokenString.contains(CSRFProtectionPrivate::sanitizeRe)) {
338  sanitized = CSRFProtectionPrivate::getNewCsrfToken();
339  } else if (token.size() != CSRF_TOKEN_LENGTH) {
340  sanitized = CSRFProtectionPrivate::getNewCsrfToken();
341  } else {
342  sanitized = token;
343  }
344 
345  return sanitized;
346 }
347 
352 QByteArray CSRFProtectionPrivate::getToken(Context *c)
353 {
354  QByteArray token;
355 
356  if (!csrf) {
357  qCCritical(C_CSRFPROTECTION) << "CSRFProtection plugin not registered";
358  return token;
359  }
360 
361  if (csrf->d_ptr->useSessions) {
362  token = Session::value(c, QStringLiteral(CSRF_SESSION_KEY)).toByteArray();
363  } else {
364  QByteArray cookieToken = c->req()->cookie(csrf->d_ptr->cookieName).toLatin1();
365 
366  if (cookieToken.isEmpty()) {
367  return token;
368  }
369 
370  token = CSRFProtectionPrivate::sanitizeToken(cookieToken);
371  if (token != cookieToken) {
372  c->setStash(CONTEXT_CSRF_COOKIE_NEEDS_RESET, true);
373  }
374  }
375 
376  qCDebug(C_CSRFPROTECTION, "Got token \"%s\" from %s.", token.constData(), csrf->d_ptr->useSessions ? "session" : "cookie");
377 
378  return token;
379 }
380 
385 void CSRFProtectionPrivate::setToken(Context *c)
386 {
387  if (!csrf) {
388  qCCritical(C_CSRFPROTECTION) << "CSRFProtection plugin not registered";
389  return;
390  }
391 
392  if (csrf->d_ptr->useSessions) {
393  Session::setValue(c, QStringLiteral(CSRF_SESSION_KEY), c->stash(CONTEXT_CSRF_COOKIE).toByteArray());
394  } else {
395  QNetworkCookie cookie(csrf->d_ptr->cookieName.toLatin1(), c->stash(CONTEXT_CSRF_COOKIE).toByteArray());
396  if (!csrf->d_ptr->cookieDomain.isEmpty()) {
397  cookie.setDomain(csrf->d_ptr->cookieDomain);
398  }
399  cookie.setExpirationDate(QDateTime::currentDateTime().addSecs(csrf->d_ptr->cookieAge));
400  cookie.setHttpOnly(csrf->d_ptr->cookieHttpOnly);
401  cookie.setPath(csrf->d_ptr->cookiePath);
402  cookie.setSecure(csrf->d_ptr->cookieSecure);
403  c->res()->setCookie(cookie);
404  c->res()->headers().pushHeader(QStringLiteral("Vary"), QStringLiteral("Cookie"));
405  }
406 
407  qCDebug(C_CSRFPROTECTION, "Set token \"%s\" to %s.", c->stash(CONTEXT_CSRF_COOKIE).toByteArray().constData(), csrf->d_ptr->useSessions ? "session" : "cookie");
408 }
409 
415 void CSRFProtectionPrivate::reject(Context *c, const QString &logReason, const QString &displayReason)
416 {
417  c->setStash(CONTEXT_CSRF_CHECK_PASSED, false);
418 
419  if (!csrf) {
420  qCCritical(C_CSRFPROTECTION) << "CSRFProtection plugin not registered";
421  return;
422  }
423 
424  qCWarning(C_CSRFPROTECTION, "Forbidden: (%s): /%s [%s]", qPrintable(logReason), qPrintable(c->req()->path()), csrf->d_ptr->logFailedIp ? qPrintable(c->req()->addressString()) : "IP logging disabled");
425 
426  c->res()->setStatus(Response::Forbidden);
427  c->setStash(csrf->d_ptr->errorMsgStashKey, displayReason);
428 
429  QString detachToCsrf = c->action()->attribute(QStringLiteral("CSRFDetachTo"));
430  if (detachToCsrf.isEmpty()) {
431  detachToCsrf = csrf->d_ptr->defaultDetachTo;
432  }
433 
434  Action *detachToAction = nullptr;
435 
436  if (!detachToCsrf.isEmpty()) {
437  detachToAction = c->controller()->actionFor(detachToCsrf);
438  if (!detachToAction) {
439  detachToAction = c->dispatcher()->getActionByPath(detachToCsrf);
440  }
441  if (!detachToAction) {
442  qCWarning(C_CSRFPROTECTION, "Can not find action for \"%s\" to detach to.", qPrintable(detachToCsrf));
443  }
444  }
445 
446  if (detachToAction) {
447  c->detach(detachToAction);
448  } else {
449  if (!csrf->d_ptr->genericErrorMessage.isEmpty()) {
450  c->res()->setBody(csrf->d_ptr->genericErrorMessage);
451  c->res()->setContentType(csrf->d_ptr->genericContentType);
452  } else {
453  const QString title = c->translate("Cutelyst::CSRFProtection", "403 Forbidden - CSRF protection check failed");
454  c->res()->setBody(QStringLiteral("<!DOCTYPE html><html><head><meta charset='utf-8'><title>") + title + QStringLiteral("</title></head><body><h1>") + title + QStringLiteral("</h1><p>") + displayReason + QStringLiteral("</p></body></html>"));
455  c->res()->setContentType(QStringLiteral("text/html; charset=utf-8"));
456  }
457  c->detach();
458  }
459 }
460 
461 void CSRFProtectionPrivate::accept(Context *c)
462 {
463  c->setStash(CONTEXT_CSRF_CHECK_PASSED, true);
464  c->setStash(CONTEXT_CSRF_PROCESSING_DONE, true);
465 }
466 
471 bool CSRFProtectionPrivate::compareSaltedTokens(const QByteArray &t1, const QByteArray &t2)
472 {
473  const QByteArray _t1 = CSRFProtectionPrivate::unsaltCipherToken(t1);
474  const QByteArray _t2 = CSRFProtectionPrivate::unsaltCipherToken(t2);
475 
476  // to avoid timing attack
477  int diff = _t1.size() ^ _t2.size();
478  for (int i = 0; i < _t1.size() && i < _t2.size(); i++) {
479  diff |= _t1[i] ^ _t2[i];
480  }
481  return diff == 0;
482 }
483 
488 void CSRFProtectionPrivate::beforeDispatch(Context *c)
489 {
490  if (!csrf) {
491  CSRFProtectionPrivate::reject(c, QStringLiteral("CSRFProtection plugin not registered"), c->translate("Cutelyst::CSRFProtection", "The CSRF protection plugin has not been registered."));
492  return;
493  }
494 
495  const QByteArray csrfToken = CSRFProtectionPrivate::getToken(c);
496  if (!csrfToken.isNull()) {
497  c->setStash(CONTEXT_CSRF_COOKIE, csrfToken);
498  } else {
500  }
501 
502  if (c->stash(CONTEXT_CSRF_PROCESSING_DONE).toBool()) {
503  return;
504  }
505 
506  if (c->action()->attributes().contains(QStringLiteral("CSRFIgnore"))) {
507  qCDebug(C_CSRFPROTECTION, "Action \"%s::%s\" is ignored by the CSRF protection.", qPrintable(c->action()->className()), qPrintable(c->action()->reverse()));
508  return;
509  }
510 
511  if (csrf->d_ptr->ignoredNamespaces.contains(c->action()->ns())) {
512  if (!c->action()->attributes().contains(QStringLiteral("CSRFRequire"))) {
513  qCDebug(C_CSRFPROTECTION, "Namespace \"%s\" is ignored by the CSRF protection.", qPrintable(c->action()->ns()));
514  return;
515  }
516  }
517 
518  // only check the tokens if the method is not secure, e.g. POST
519  // the following methods are secure according to RFC 7231: GET, HEAD, OPTIONS and TRACE
520  if (!CSRFProtectionPrivate::secureMethods.contains(c->req()->method())) {
521 
522  bool ok = true;
523 
524  // Suppose user visits http://example.com/
525  // An active network attacker (man-in-the-middle, MITM) sends a POST form that targets
526  // https://example.com/detonate-bomb/ and submits it via JavaScript.
527  //
528  // The attacker will need to provide a CSRF cookie and token, but that's no problem for a
529  // MITM and the session-independent secret we're using. So the MITM can circumvent the CSRF
530  // protection. This is true for any HTTP connection, but anyone using HTTPS expects better!
531  // For this reason, for https://example.com/ we need additional protection that treats
532  // http://example.com/ as completely untrusted. Under HTTPS, Barth et al. found that the
533  // Referer header is missing for same-domain requests in only about 0.2% of cases or less, so
534  // we can use strict Referer checking.
535  if (c->req()->secure()) {
536  const QString referer = c->req()->headers().referer();
537 
538  if (Q_UNLIKELY(referer.isEmpty())) {
539  CSRFProtectionPrivate::reject(c, QStringLiteral("Referer checking failed - no Referer."), c->translate("Cutelyst::CSRFProtection", "Referer checking failed - no Referer."));
540  ok = false;
541  } else {
542  const QUrl refererUrl(referer);
543  if (Q_UNLIKELY(!refererUrl.isValid())) {
544  CSRFProtectionPrivate::reject(c, QStringLiteral("Referer checking failed - Referer is malformed."), c->translate("Cutelyst::CSRFProtection", "Referer checking failed - Referer is malformed."));
545  ok = false;
546  } else {
547  if (Q_UNLIKELY(refererUrl.scheme() != QLatin1String("https"))) {
548  CSRFProtectionPrivate::reject(c, QStringLiteral("Referer checking failed - Referer is insecure while host is secure."), c->translate("Cutelyst::CSRFProtection", "Referer checking failed - Referer is insecure while host is secure."));
549  ok = false;
550  } else {
551  // If there isn't a CSRF_COOKIE_DOMAIN, require an exact match on host:port.
552  // If not, obey the cookie rules (or those for the session cookie, if we
553  // use sessions
554  const QUrl uri = c->req()->uri();
555  QString goodReferer;
556  if (!csrf->d_ptr->useSessions) {
557  goodReferer = csrf->d_ptr->cookieDomain;
558  }
559  if (goodReferer.isEmpty()) {
560  goodReferer = uri.host();
561  }
562  const int serverPort = uri.port(c->req()->secure() ? 443 : 80);
563  if ((serverPort != 80) && (serverPort != 443)) {
564  goodReferer += QLatin1Char(':') + QString::number(serverPort);
565  }
566 
567  QStringList goodHosts = csrf->d_ptr->trustedOrigins;
568  goodHosts.append(goodReferer);
569 
570  QString refererHost = refererUrl.host();
571  const int refererPort = refererUrl.port(refererUrl.scheme() == QLatin1String("https") ? 443 : 80);
572  if ((refererPort != 80) && (refererPort != 443)) {
573  refererHost += QLatin1Char(':') + QString::number(refererPort);
574  }
575 
576  bool refererCheck = false;
577  for (int i = 0; i < goodHosts.size(); ++i) {
578  const QString host = goodHosts.at(i);
579  if ((host.startsWith(QLatin1Char('.')) && (refererHost.endsWith(host) || (refererHost == host.mid(1)))) || host == refererHost) {
580  refererCheck = true;
581  break;
582  }
583  }
584 
585  if (Q_UNLIKELY(!refererCheck)) {
586  ok = false;
587  CSRFProtectionPrivate::reject(c, QStringLiteral("Referer checking failed - %1 does not match any trusted origins.").arg(referer), c->translate("Cutelyst::CSRFProtection", "Referer checking failed - %1 does not match any trusted origins.").arg(referer));
588  }
589  }
590  }
591  }
592  }
593 
594  if (Q_LIKELY(ok)) {
595  if (Q_UNLIKELY(csrfToken.isEmpty())) {
596  CSRFProtectionPrivate::reject(c, QStringLiteral("CSRF cookie not set."), c->translate("Cutelyst::CSRFProtection", "CSRF cookie not set."));
597  ok = false;
598  } else {
599 
600  QByteArray requestCsrfToken;
601  // delete does not have body data
602  if (c->req()->method() != QLatin1String("DELETE")) {
603  if (c->req()->contentType() == QLatin1String("multipart/form-data")) {
604  // everything is an upload, even our token
605  Upload *upload = c->req()->upload(csrf->d_ptr->formInputName);
606  if (upload && upload->size() < 1024 /*FIXME*/) {
607  requestCsrfToken = upload->readAll();
608  }
609  } else
610  requestCsrfToken = c->req()->bodyParam(csrf->d_ptr->formInputName).toLatin1();
611  }
612 
613  if (requestCsrfToken.isEmpty()) {
614  requestCsrfToken = c->req()->header(csrf->d_ptr->headerName).toLatin1();
615  if (Q_LIKELY(!requestCsrfToken.isEmpty())) {
616  qCDebug(C_CSRFPROTECTION, "Got token \"%s\" from HTTP header %s.", requestCsrfToken.constData(), qPrintable(csrf->d_ptr->headerName));
617  } else {
618  qCDebug(C_CSRFPROTECTION, "Can not get token from HTTP header or form field.");
619  }
620  } else {
621  qCDebug(C_CSRFPROTECTION, "Got token \"%s\" from form field %s.", requestCsrfToken.constData(), qPrintable(csrf->d_ptr->formInputName));
622  }
623 
624  requestCsrfToken = CSRFProtectionPrivate::sanitizeToken(requestCsrfToken);
625 
626  if (Q_UNLIKELY(!CSRFProtectionPrivate::compareSaltedTokens(requestCsrfToken, csrfToken))) {
627  CSRFProtectionPrivate::reject(c, QStringLiteral("CSRF token missing or incorrect."), c->translate("Cutelyst::CSRFProtection", "CSRF token missing or incorrect."));
628  ok = false;
629  }
630  }
631  }
632 
633  if (Q_LIKELY(ok)) {
634  CSRFProtectionPrivate::accept(c);
635  }
636  }
637 
638  // Set the CSRF cookie even if it's already set, so we renew
639  // the expiry timer.
640 
641  if (!c->stash(CONTEXT_CSRF_COOKIE_NEEDS_RESET).toBool()) {
642  if (c->stash(CONTEXT_CSRF_COOKIE_SET).toBool()) {
643  return;
644  }
645  }
646 
647  if (!c->stash(CONTEXT_CSRF_COOKIE_USED).toBool()) {
648  return;
649  }
650 
651  CSRFProtectionPrivate::setToken(c);
652  c->setStash(CONTEXT_CSRF_COOKIE_SET, true);
653 }
654 
655 #include "moc_csrfprotection.cpp"
void pushHeader(const QString &field, const QString &value)
Definition: headers.cpp:363
void setCookie(const QNetworkCookie &cookie)
Definition: response.cpp:211
void setHeaderName(const QString &headerName)
void setContentType(const QString &type)
Definition: response.h:206
QMap< QString, QString > attributes() const
Definition: action.cpp:81
Engine * engine() const
Dispatcher * dispatcher() const
Definition: context.cpp:152
Response * res() const
Definition: context.cpp:116
void setStash(const QString &key, const QVariant &value)
Definition: context.cpp:207
void detach(Action *action=nullptr)
Definition: context.cpp:317
void loadTranslations(const QString &filename, const QString &directory=QString(), const QString &prefix=QString(), const QString &suffix=QString())
Action * actionFor(const QString &name) const
Definition: controller.cpp:48
void setStatus(quint16 status)
Definition: response.cpp:85
T plugin()
Returns the registered plugin that casts to the template type T.
Definition: application.h:115
QString ns() const
Definition: action.cpp:131
void setGenericErrorContentTyp(const QString &type)
This class represents a Cutelyst Action.
Definition: action.h:47
void setIgnoredNamespaces(const QStringList &namespaces)
Cutelyst Upload handles file upload request
Definition: upload.h:35
virtual bool setup(Application *app) override
The Cutelyst Context.
Definition: context.h:50
QString addressString() const
Definition: request.cpp:50
QString bodyParam(const QString &key, const QString &defaultValue=QString()) const
Definition: request.h:533
Upload * upload(const QString &name) const
Definition: request.h:566
static bool checkPassed(Context *c)
QVariantMap config(const QString &entity) const
user configuration for the application
Definition: engine.cpp:323
Headers & headers()
Definition: response.cpp:290
void setDefaultDetachTo(const QString &actionNameOrPath)
QString header(const QString &key) const
Definition: request.h:557
QString translate(const char *context, const char *sourceText, const char *disambiguation=nullptr, int n=-1) const
Definition: context.cpp:414
QString attribute(const QString &name, const QString &defaultValue=QString()) const
Definition: action.cpp:87
static void setValue(Context *c, const QString &key, const QVariant &value)
Definition: session.cpp:176
void setFormFieldName(const QString &fieldName)
Protect input forms against Cross Site Request Forgery (CSRF/XSRF) attacks.
The Cutelyst namespace holds all public Cutelyst API.
Definition: Mainpage.dox:7
QString reverse() const
Definition: component.cpp:51
void beforeDispatch(Context *c)
void setCookieName(const QString &cookieName)
void setUseSessions(bool useSessions)
void setCookieHttpOnly(bool httpOnly)
void postForked(Application *app)
void setGenericErrorMessage(const QString &message)
static QVariant value(Context *c, const QString &key, const QVariant &defaultValue=QVariant())
Definition: session.cpp:161
void setErrorMsgStashKey(const QString &keyName)
QString cookie(const QString &name) const
Definition: request.cpp:284
The Cutelyst Application.
Definition: application.h:55
CSRFProtection(Application *parent)
void setBody(QIODevice *body)
Definition: response.cpp:114
Action * getActionByPath(const QString &path) const
Definition: dispatcher.cpp:231
static QString getTokenFormField(Context *c)
static QByteArray getToken(Context *c)
virtual qint64 size() const override
Definition: upload.cpp:153
void stash(const QVariantHash &unite)
Definition: context.h:515
QString className() const
Definition: action.cpp:99