wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use StringUtils::equals on CSRF token and add unit tests

Browse source
This commit is contained in:
Lukas Reschke 2015-08-04 18:34:33 +02:00
parent 728780aee8
commit 4efa7c09b1
2 changed files with 99 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/private/appframework/http/request.php
View file

@ -33,6 +33,7 @@ use OC\Security\TrustedDomainHelper;
use OCP\IConfig;
use OCP\IRequest;
use OCP\Security\ISecureRandom;
use OCP\Security\StringUtils;
/**
* Class for accessing variables in the request.
@ -416,12 +417,10 @@ class Request implements \ArrayAccess, \Countable, IRequest {
}
// Check if the token is valid
if($token !== $this->items['requesttoken']) {
// Not valid
return false;
} else {
// Valid token
if(StringUtils::equals($token, $this->items['requesttoken'])) {
return true;
} else {
return false;
}
}

95
tests/lib/appframework/http/RequestTest.php
View file

@ -1156,4 +1156,99 @@ class RequestTest extends \Test\TestCase {
$this->assertSame($expectedUri, $request->getRequestUri());
}
public function testPassesCSRFCheckWithGet() {
/** @var Request $request */
$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
->setMethods(['getScriptName'])
->setConstructorArgs([
[
'get' => [
'requesttoken' => 'MyStoredRequestToken',
],
'requesttoken' => 'MyStoredRequestToken',
],
$this->secureRandom,
$this->config,
$this->stream
])
->getMock();
$this->assertTrue($request->passesCSRFCheck());
}
public function testPassesCSRFCheckWithPost() {
/** @var Request $request */
$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
->setMethods(['getScriptName'])
->setConstructorArgs([
[
'post' => [
'requesttoken' => 'MyStoredRequestToken',
],
'requesttoken' => 'MyStoredRequestToken',
],
$this->secureRandom,
$this->config,
$this->stream
])
->getMock();
$this->assertTrue($request->passesCSRFCheck());
}
public function testPassesCSRFCheckWithHeader() {
/** @var Request $request */
$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
->setMethods(['getScriptName'])
->setConstructorArgs([
[
'server' => [
'HTTP_REQUESTTOKEN' => 'MyStoredRequestToken',
],
'requesttoken' => 'MyStoredRequestToken',
],
$this->secureRandom,
$this->config,
$this->stream
])
->getMock();
$this->assertTrue($request->passesCSRFCheck());
}
public function testPassesCSRFCheckWithInvalidToken() {
/** @var Request $request */
$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
->setMethods(['getScriptName'])
->setConstructorArgs([
[
'server' => [
'HTTP_REQUESTTOKEN' => 'MyInvalidSentToken',
],
'requesttoken' => 'MyStoredRequestToken',
],
$this->secureRandom,
$this->config,
$this->stream
])
->getMock();
$this->assertFalse($request->passesCSRFCheck());
}
public function testPassesCSRFCheckWithoutTokenFail() {
/** @var Request $request */
$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
->setMethods(['getScriptName'])
->setConstructorArgs([
[],
$this->secureRandom,
$this->config,
$this->stream
])
->getMock();
$this->assertFalse($request->passesCSRFCheck());
}
}