File Coverage

lib/Mojolicious/Plugin/CSRFProtect.pm

Criterion	Covered	Total	%
statement	59	65	90.7
branch	9	12	75.0
condition	9	18	50.0
subroutine	14	15	93.3
pod	1	1	100.0
total	92	111	82.8

package Mojolicious::Plugin::CSRFProtect;
use strict;
use warnings;
use Carp qw/croak/;

use Mojo::Base 'Mojolicious::Plugin';
use Mojo::Util qw/md5_sum/;
use Mojo::ByteStream qw/b/;

our $VERSION = '0.16';

sub register {
    my ( $self, $app, $conf ) = @_;

    # On error callback
    my $on_error;
    if ( $conf->{on_error} && ref($conf->{on_error}) eq 'CODE' ) {
        $on_error = $conf->{on_error};
    } else {
        $on_error = sub { shift->render( status => 403, text => "Forbidden!" ) };
    }

    # Replace "form_for" helper
    my $original_form_for = delete $app->renderer->helpers->{form_for};
    croak qq{Cannot find helper "form_for". Please, load plugin "TagHelpers" before}
        unless $original_form_for;

    $app->helper(
        form_for => sub {
            my $c = shift;
            if ( defined $_[-1] && ref( $_[-1] ) eq 'CODE' ) {
                my $cb = $_[-1];
                $_[-1] = sub {
                    $app->hidden_field( 'csrftoken' => $self->_csrftoken($c) ) . $cb->();
                };
            }
            return $app->$original_form_for(@_);
        } );

    # Add "csrftoken" helper
    $app->helper( csrftoken => sub { $self->_csrftoken( $_[0] ) } );

    # Add "is_valid_csrftoken" helper
    $app->helper( is_valid_csrftoken => sub { $self->_is_valid_csrftoken( $_[0] ) } );

    # Add "jquery_ajax_csrf_protection" helper
    $app->helper(
        jquery_ajax_csrf_protection => sub {
            my $js = '';
            $js .= q!!; </td>
</tr>

<tr>
<td  class="h" >
<a name="51">51</a>
</td>

<td  class="c3" >

1

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

3

</td>

<td class="s">             $js .= q! jQuery(document).ajaxSend(function(e, xhr, options) { !; </td>
</tr>

<tr>
<td  class="h" >
<a name="52">52</a>
</td>

<td  class="c3" >

1

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

4

</td>

<td class="s">             $js .= q!    var token = jQuery("meta[name='csrftoken']").attr("content");!; </td>
</tr>

<tr>
<td  class="h" >
<a name="53">53</a>
</td>

<td  class="c3" >

1

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

4

</td>

<td class="s">             $js .= q! xhr.setRequestHeader("X-CSRF-Token", token);!; </td>
</tr>

<tr>
<td  class="h" >
<a name="54">54</a>
</td>

<td  class="c3" >

1

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

&nbsp;

</td>

<td >

2

</td>

<td class="s">             $js .= q! });!;

            b($js);
        } );

    # input check
    $app->hook(
        before_routes => sub {
            my ($c) = @_;

            my $request_token = $c->req->param('csrftoken');
            #my $is_ajax = ( $c->req->headers->header('X-Requested-With') || '' ) eq 'XMLHttpRequest';

            if ( $c->req->method !~ m/^(?:GET|HEAD|OPTIONS)$/ && !$self->_is_valid_csrftoken($c) ) {
                my $path = $c->tx->req->url->to_abs->to_string;
                $c->app->log->debug("CSRFProtect: Wrong CSRF protection token for [$path]!");

                $on_error->($c);
                return;
            }

            return 1;
        } );

}

sub _is_valid_csrftoken {
    my ( $self, $c ) = @_;

    my $valid_token = $c->session('csrftoken');
    my $form_token = $c->req->headers->header('X-CSRF-Token') || $c->param('csrftoken');
    unless ( $valid_token && $form_token && $form_token eq $valid_token ) {
        return 0;
    }

    return 1;
}

sub _csrftoken {
    my ( $self, $c ) = @_;

    return $c->session('csrftoken') if $c->session('csrftoken');

    my $token = md5_sum( md5_sum( time() . {} . rand() . $$ ) );

    $c->session( 'csrftoken' => $token );
    return $token;
}

1;

__END__