File Coverage

blib/lib/Plack/Middleware/CSRFBlock.pm

Criterion	Covered	Total	%
statement	97	99	97.9
branch	33	40	82.5
condition	18	25	72.0
subroutine	18	18	100.0
pod	2	4	50.0
total	168	186	90.3

package Plack::Middleware::CSRFBlock;
$Plack::Middleware::CSRFBlock::VERSION = '0.10';
use parent qw(Plack::Middleware);
use strict;
use warnings;

# ABSTRACT: Block CSRF Attacks with minimal changes to your app

use Digest::SHA1;
use Time::HiRes qw(time);
use HTML::Parser;
use Plack::Request;
use Plack::TempBuffer;
use Plack::Util;
use Plack::Util::Accessor qw(
    parameter_name header_name add_meta meta_tag token_length
    session_key blocked onetime _token_generator logger
);

sub prepare_app {
    my ($self) = @_;

    $self->parameter_name('SEC') unless defined $self->parameter_name;
    $self->token_length(16) unless defined $self->token_length;
    $self->session_key('csrfblock.token') unless defined $self->session_key;

    # Upper-case header name and replace - with _
    my $header_name = uc($self->header_name || 'X-CSRF-Token');
    $header_name =~ s/-/_/g;
    $self->header_name($header_name);

    $self->_token_generator(sub {
        my $token = Digest::SHA1::sha1_hex(rand() . $$ . {} . time);
        substr($token, 0 , $self->token_length);
    });
}

sub log {
    my ($self, $level, $msg) = @_;

    $self->logger->({ level => $level, message => "CSRFBlock: $msg" });
}

sub call {
    my($self, $env) = @_;

    # cache the logger
    $self->logger($env->{'psgix.logger'} || sub { }) unless defined $self->logger;

    # Generate a Plack Request for this request
    my $request = Plack::Request->new($env);

    # We need a session
    my $session = $request->session;
    unless ($session) {
        $self->log( error => 'No session found!' );
        die "CSRFBlock needs Session." unless $session;
    }

    my $token = $session->{$self->session_key};
    if($request->method =~ m{^post$}i) {
        # Log the request with env info
        $self->log(debug => 'Got POST Request');

        # If we don't have a token, can't do anything
        return $self->token_not_found($env) unless $token;

        my $found;

        # First, check if the header is set correctly.
        $found = ( $request->header( $self->header_name ) || '') eq $token;

        $self->log(debug => 'Found in Header? : ' . ($found ? 1 : 0));

        # If the token wasn't set, let's check the params
        unless ($found) {
            my $val = $request->parameters->{ $self->parameter_name } || '';
            $found = $val eq $token;
            $self->log(debug => 'Found in parameters : ' . ($found ? 1 : 0));
        }

        return $self->token_not_found($env) unless $found;

        # If we are using onetime token, remove it from the session
        delete $session->{$self->session_key} if $self->onetime;
    }

    return $self->response_cb($self->app->($env), sub {
        my $res = shift;
        my $ct = Plack::Util::header_get($res->[1], 'Content-Type') || '';
        if($ct !~ m{^text/html}i and $ct !~ m{^application/xhtml[+]xml}i){
            return $res;
        }

        my @out;
        my $http_host = $request->uri->host;
        my $token = $session->{$self->session_key} ||= $self->_token_generator->();
        my $parameter_name = $self->parameter_name;

        my $p = HTML::Parser->new(
            api_version => 3,
            start_h => [sub {
                my($tag, $attr, $text) = @_;
                push @out, $text;

                no warnings 'uninitialized';

                $tag = lc($tag);
                # If we found the head tag and we want to add a  tag
                if( $tag eq 'head' && $self->meta_tag) {
                    # Put the csrftoken in a  element in
                    # So that you can get the token in javascript in your
                    # App to set in X-CSRF-Token header for all your AJAX
                    # Requests
                    push @out, q{};
                }

                # If tag isn't 'form' and method isn't 'post' we dont care
                return unless $tag eq 'form' && $attr->{'method'} =~ /post/i;

                if(
                    !($attr->{'action'} =~ m{^https?://([^/:]+)[/:]}
                            and $1 ne $http_host)
                ) {
                    push @out, '
                               "name=\"$parameter_name\" value=\"$token\" />";
                }

                # TODO: determine xhtml or html?
                return;
            }, "tagname, attr, text"],
            default_h => [\@out , '@{text}'],
        );
        my $done;

        return sub {
            return if $done;

            if(defined(my $chunk = shift)) {
                $p->parse($chunk);
            }
            else {
                $p->eof;
                $done++;
            }
            join '', splice @out;
        }
    });
}

sub token_not_found {
    my ($self, $env) = (shift, shift);

    $self->log(error => 'Token not found, returning 403!');

    if(my $app_for_blocked = $self->blocked) {
        return $app_for_blocked->($env, @_);
    }
    else {
        my $body = 'CSRF detected';
        return [
            403,
            [ 'Content-Type' => 'text/plain', 'Content-Length' => length($body) ],
            [ $body ]
        ];
    }
}

1;

__END__