File Coverage

blib/lib/Mojolicious/Plugin/CSRF.pm

Criterion	Covered	Total	%
statement	81	81	100.0
branch	18	28	64.2
condition	13	26	50.0
subroutine	17	17	100.0
pod	1	1	100.0
total	130	153	84.9

package Mojolicious::Plugin::CSRF;
# ABSTRACT: Cross Site Request Forgery (CSRF) "prevention" Mojolicious plugin

use 5.016;
use strict;
use warnings;
use Mojo::Base 'Mojolicious::Plugin';
use Mojo::DOM;
use Mojo::Util;

our $VERSION = '1.05'; # VERSION

sub register {
    my ( $self, $app, $conf ) = @_;

    my $csrf = Mojolicious::Plugin::CSRF::Base->new( ( ref $conf eq 'HASH' ) ? %$conf : () );
    $app->helper( csrf => sub { $csrf->c( $_[0] ) } );

    $conf->{hooks} //= [
        before_routes => sub {
            my ($c) = @_;
            $c->csrf->setup;
            $c->csrf->check;
        },
        after_render => sub {
            my ( $c, $output, $format ) = @_;

            if ( $format eq 'html' and $$output ) {
                my $dom   = Mojo::DOM->new( Mojo::Util::decode( 'UTF-8', $$output ) );
                my $forms = $dom->find('form[method="post"]');

                if ( $forms->size ) {
                    $forms->each( sub {
                        $_->append_content(
                            '
                                'name="'  . $c->csrf->token_name . '" ' .
                                'value="' . $c->csrf->token . '">'
                        );
                    } );
                    $$output = Mojo::Util::encode( 'UTF-8', $dom->to_string );
                }
            }
        },
    ];

    $app->hook( shift @{ $conf->{hooks} }, shift @{ $conf->{hooks} } )
        while ( ref $conf->{hooks} eq 'ARRAY' and @{ $conf->{hooks} } and not @{ $conf->{hooks} } % 2 );

    return;
}

package Mojolicious::Plugin::CSRF::Base;

use Mojo::Base -base;
use Crypt::URandom;

has c              => undef;
has generate_token => sub { sub { unpack( 'H*', Crypt::URandom::urandom(16) ) } };
has token_name     => 'csrf_token';
has header         => 'X-CSRF-Token';
has methods        => sub { [ qw( POST PUT DELETE PATCH ) ] };
has include        => undef;
has exclude        => undef;

has on_success => sub { sub {
    my ($c) = @_;
    $c->log->info('CSRF check success');
    return 1;
} };

has on_failure => sub { sub {
    my ($c) = @_;
    $c->reply->exception( 'Access Forbidden: CSRF check failure', { status => 403 } );
    return 0;
} };

sub setup {
    my ($self) = @_;
    $self->c->res->headers->add( $self->header => $self->token );
    return $self;
}

sub check {
    my ($self) = @_;

    my $path = $self->c->req->url->path->to_string;
    return if ( $self->c->app->static->file($path) );

    my $method  = $self->c->req->method;
    my @methods = @{ ( $self->methods and ref $self->methods eq 'ARRAY' ) ? $self->methods : [] };
    @methods    = 'any' unless @methods;
    return unless ( grep { uc $_ eq $method or lc $_ eq 'any' } @methods );

    if ( $self->include and ref $self->include eq 'ARRAY' ) {
        my $include = 0;
        for ( @{ $self->include } ) {
            if ( $path =~ $_ ) {
                $include = 1;
                last;
            }
        }
        return unless $include;
    }

    if ( $self->exclude and ref $self->exclude eq 'ARRAY' ) {
        for ( @{ $self->exclude } ) {
            return if ( $path =~ $_ );
        }
    }

    my $session = $self->c->session( $self->token_name );
    my $param   = $self->c->param( $self->token_name );
    my $header  = $self->c->req->headers->header( $self->header );
    my $on      = 'on_' . ( (
        not $session or
        not (
            $param  and $param  eq $session or
            $header and $header eq $session
        )
    ) ? 'failure' : 'success' );

    return $self->$on->( $self->c );
}

sub token {
    my ($self) = @_;
    return
        $self->c->session( $self->token_name ) ||
        $self->c->session( $self->token_name => $self->generate_token->() )->session( $self->token_name );
}

sub url_for {
    my ( $self, @params ) = @_;
    return $self->c->url_for(@params)->query( { $self->token_name => $self->token } );
}

sub delete_token {
    my ($self) = @_;
    delete $self->c->session->{ $self->token_name };
    return $self;
}

1;

__END__