feature: configure whitelisted global variables

Author: Greg Bowler

config.default.ini

@@ -5,6 +5,12 @@ service_loader=ServiceLoader
 slow_delta=0.25
 very_slow_delta=0.50
 render_buffer_size=1024
+globals_whitelist_env=
+globals_whitelist_server=
+globals_whitelist_get=xdebug
+globals_whitelist_post=
+globals_whitelist_files=
+globals_whitelist_cookies=
 
 [router]
 router_file=router.php
@@ -43,3 +49,4 @@ query_path=query
 
 [security]
 ;default_headers="X-Content-Type-Options: nosniff; X-Frame-Options: deny; Content-Security-Policy: default-src 'none'"
+csrf_header=X-CSRF

src/Middleware/RequestHandler.php

@@ -149,8 +149,6 @@ public function handle(
 			$serviceContainer->set($viewModel);
 		}
 
-// TODO: Set a Session loader here, so the CSRF handler can use it.
-
 		if($viewModel instanceof HTMLDocument) {
 			try {
 				$partial = new PartialContent(implode(DIRECTORY_SEPARATOR, [
@@ -200,7 +198,7 @@ public function handle(
 
 			$session = $serviceContainer->get(Session::class);
 			$csrfTokenStore = new SessionTokenStore(
-				$session->getStore("csrf", true)
+				$session->getStore("webengine.csrf", true)
 			);
 
 			if($request->getMethod() === "POST") {
@@ -209,16 +207,20 @@ public function handle(
 
 			$protector = new HTMLDocumentProtector($viewModel, $csrfTokenStore);
 			$tokens = $protector->protect(HTMLDocumentProtector::ONE_TOKEN_PER_FORM);
-			$response = $response->withHeader("x-csrf", $tokens);
+			$response = $response->withHeader($this->config->getString("security.csrf_header"), $tokens);
 		}
 
 		$input = new Input($_GET, $_POST, $_FILES);
 		$serviceContainer->set($input);
 
 		Protection::overrideInternals(
 			Protection::removeGlobals($GLOBALS, [
-// TODO: Configure the whitelisted globals.
-				"_GET" => ["xdebug"],
+				"_ENV" => explode(",", $this->config->getString("app.globals_whitelist_env") ?? ""),
+				"_SERVER" => explode(",", $this->config->getString("app.globals_whitelist_server") ?? ""),
+				"_GET" => explode(",", $this->config->getString("app.globals_whitelist_get") ?? ""),
+				"_POST" => explode(",", $this->config->getString("app.globals_whitelist_post") ?? ""),
+				"_FILES" => explode(",", $this->config->getString("app.globals_whitelist_files") ?? ""),
+				"_COOKIES" => explode(",", $this->config->getString("app.globals_whitelist_cookies") ?? ""),
 			]
 		));