File Coverage

lib/Mojolicious/Plugin/DeCSRF.pm

Criterion	Covered	Total	%
statement	47	47	100.0
branch	24	24	100.0
condition	9	11	81.8
subroutine	9	9	100.0
pod	1	1	100.0
total	90	92	97.8

package Mojolicious::Plugin::DeCSRF;

use Mojo::Base 'Mojolicious::Plugin';

our $VERSION = '0.94';

sub register {
	my ($self, $app, $conf) = @_;

	my $base = Mojolicious::Plugin::DeCSRF::Base->new;
	$base->{token_length} = $conf->{token_length} if $conf->{token_length};
	$base->{token_name} = $conf->{token_name} if $conf->{token_name};
	$base->{on_mismatch} = $conf->{on_mismatch} if $conf->{on_mismatch};
	push @{$base->urls}, $conf->{urls} if $conf->{urls};

	$app->helper(decsrf => sub { $base->c(shift) });

	$app->hook(before_dispatch => sub {
			my $c = shift;
			return $c if $base->c($c)->check;
			if ($base->on_mismatch && ref($base->on_mismatch) eq 'CODE') {
				$base->on_mismatch->($c);
			} else {
				$c->render(
					text => "Forbidden!",
					status => 403,
				);
			}
		}
	);
}

package Mojolicious::Plugin::DeCSRF::Base;

use Mojo::Base -base;

my $_token_checked = 1;
has c => undef;
has token_length => 4;
has token_name => 'token';
has on_mismatch => undef;
has urls => sub { [] };

sub check {
	my $self = shift;
	my $c = $self->c;
	my $token = $c->session($self->token_name);
	$_token_checked = 1;
	if ($self->_match($c->req->url))
	{
		return 0 unless (
				$c->req->param($self->token_name)
				&& $c->req->param($self->token_name) eq $token
			);
	};
	return 1;
}

sub url {
	my $self = shift;
	my $url = shift // '';
	my $c = $self->c;
	if ($_token_checked) {
		$c->session($self->token_name => $self->_token);
		$_token_checked = 0;
	}
	if ($self->_match($url)) {
		return $c->url_for($url)->query([$self->token_name => $c->session($self->token_name)]);
	}
	return $c->url_for($url);
}

sub _match {
	my ($self, $url) = @_;
	if (@{$self->urls} && $url) {
		foreach (@{$self->urls}) {
			return 1 if $self->c->url_for($url)->path =~ m;^$_$;;
		}
	}
	return 0;
}

sub _token {
	my @chars = ( "A" .. "Z", "a" .. "z", 0 .. 9, qw(@ $ - _) );
	return join("", @chars[ map { rand @chars } ( 1 .. shift->token_length ) ]);
}

1;

__END__