Skip to content

Commit dd7c6eb

Browse files
jderussejderusse
committed
Enable CSRF in FORM by default
1 parent d1f7dac commit dd7c6eb

File tree

5 files changed

+108
-59
lines changed

5 files changed

+108
-59
lines changed

‎DependencyInjection/FrameworkExtension.php‎

Lines changed: 66 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -311,26 +311,6 @@ public function load(array $configs, ContainerBuilder $container)
311311
$this->registerRequestConfiguration($config['request'], $container, $loader);
312312
}
313313

314-
if ($this->isConfigEnabled($container, $config['form'])) {
315-
if (!class_exists(Form::class)) {
316-
throw new LogicException('Form support cannot be enabled as the Form component is not installed. Try running "composer require symfony/form".');
317-
}
318-
319-
$this->formConfigEnabled = true;
320-
$this->registerFormConfiguration($config, $container, $loader);
321-
322-
if (ContainerBuilder::willBeAvailable('symfony/validator', Validation::class, ['symfony/framework-bundle', 'symfony/form'])) {
323-
$config['validation']['enabled'] = true;
324-
} else {
325-
$container->setParameter('validator.translation_domain', 'validators');
326-
327-
$container->removeDefinition('form.type_extension.form.validator');
328-
$container->removeDefinition('form.type_guesser.validator');
329-
}
330-
} else {
331-
$container->removeDefinition('console.command.form_debug');
332-
}
333-
334314
if ($this->isConfigEnabled($container, $config['assets'])) {
335315
if (!class_exists(\Symfony\Component\Asset\Package::class)) {
336316
throw new LogicException('Asset support cannot be enabled as the Asset component is not installed. Try running "composer require symfony/asset".');
@@ -339,39 +319,6 @@ public function load(array $configs, ContainerBuilder $container)
339319
$this->registerAssetsConfiguration($config['assets'], $container, $loader);
340320
}
341321

342-
if ($this->messengerConfigEnabled = $this->isConfigEnabled($container, $config['messenger'])) {
343-
$this->registerMessengerConfiguration($config['messenger'], $container, $loader, $config['validation']);
344-
} else {
345-
$container->removeDefinition('console.command.messenger_consume_messages');
346-
$container->removeDefinition('console.command.messenger_debug');
347-
$container->removeDefinition('console.command.messenger_stop_workers');
348-
$container->removeDefinition('console.command.messenger_setup_transports');
349-
$container->removeDefinition('console.command.messenger_failed_messages_retry');
350-
$container->removeDefinition('console.command.messenger_failed_messages_show');
351-
$container->removeDefinition('console.command.messenger_failed_messages_remove');
352-
$container->removeDefinition('cache.messenger.restart_workers_signal');
353-
354-
if ($container->hasDefinition('messenger.transport.amqp.factory') && !class_exists(AmqpTransportFactory::class)) {
355-
if (class_exists(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)) {
356-
$container->getDefinition('messenger.transport.amqp.factory')
357-
->setClass(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)
358-
->addTag('messenger.transport_factory');
359-
} else {
360-
$container->removeDefinition('messenger.transport.amqp.factory');
361-
}
362-
}
363-
364-
if ($container->hasDefinition('messenger.transport.redis.factory') && !class_exists(RedisTransportFactory::class)) {
365-
if (class_exists(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)) {
366-
$container->getDefinition('messenger.transport.redis.factory')
367-
->setClass(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)
368-
->addTag('messenger.transport_factory');
369-
} else {
370-
$container->removeDefinition('messenger.transport.redis.factory');
371-
}
372-
}
373-
}
374-
375322
if ($this->httpClientConfigEnabled = $this->isConfigEnabled($container, $config['http_client'])) {
376323
$this->registerHttpClientConfiguration($config['http_client'], $container, $loader, $config['profiler']);
377324
}
@@ -380,18 +327,12 @@ public function load(array $configs, ContainerBuilder $container)
380327
$this->registerMailerConfiguration($config['mailer'], $container, $loader);
381328
}
382329

383-
if ($this->notifierConfigEnabled = $this->isConfigEnabled($container, $config['notifier'])) {
384-
$this->registerNotifierConfiguration($config['notifier'], $container, $loader);
385-
}
386-
387330
$propertyInfoEnabled = $this->isConfigEnabled($container, $config['property_info']);
388-
$this->registerValidationConfiguration($config['validation'], $container, $loader, $propertyInfoEnabled);
389331
$this->registerHttpCacheConfiguration($config['http_cache'], $container, $config['http_method_override']);
390332
$this->registerEsiConfiguration($config['esi'], $container, $loader);
391333
$this->registerSsiConfiguration($config['ssi'], $container, $loader);
392334
$this->registerFragmentsConfiguration($config['fragments'], $container, $loader);
393335
$this->registerTranslatorConfiguration($config['translator'], $container, $loader, $config['default_locale']);
394-
$this->registerProfilerConfiguration($config['profiler'], $container, $loader);
395336
$this->registerWorkflowConfiguration($config['workflows'], $container, $loader);
396337
$this->registerDebugConfiguration($config['php_errors'], $container, $loader);
397338
$this->registerRouterConfiguration($config['router'], $container, $loader, $config['translator']['enabled_locales'] ?? []);
@@ -461,6 +402,72 @@ public function load(array $configs, ContainerBuilder $container)
461402
}
462403
$this->registerSecurityCsrfConfiguration($config['csrf_protection'], $container, $loader);
463404

405+
// form depends on csrf being registered
406+
if ($this->isConfigEnabled($container, $config['form'])) {
407+
if (!class_exists(Form::class)) {
408+
throw new LogicException('Form support cannot be enabled as the Form component is not installed. Try running "composer require symfony/form".');
409+
}
410+
411+
$this->formConfigEnabled = true;
412+
$this->registerFormConfiguration($config, $container, $loader);
413+
414+
if (ContainerBuilder::willBeAvailable('symfony/validator', Validation::class, ['symfony/framework-bundle', 'symfony/form'])) {
415+
$config['validation']['enabled'] = true;
416+
} else {
417+
$container->setParameter('validator.translation_domain', 'validators');
418+
419+
$container->removeDefinition('form.type_extension.form.validator');
420+
$container->removeDefinition('form.type_guesser.validator');
421+
}
422+
} else {
423+
$container->removeDefinition('console.command.form_debug');
424+
}
425+
426+
// validation depends on form, annotations being registered
427+
$this->registerValidationConfiguration($config['validation'], $container, $loader, $propertyInfoEnabled);
428+
429+
// messenger depends on validation being registered
430+
if ($this->messengerConfigEnabled = $this->isConfigEnabled($container, $config['messenger'])) {
431+
$this->registerMessengerConfiguration($config['messenger'], $container, $loader, $config['validation']);
432+
} else {
433+
$container->removeDefinition('console.command.messenger_consume_messages');
434+
$container->removeDefinition('console.command.messenger_debug');
435+
$container->removeDefinition('console.command.messenger_stop_workers');
436+
$container->removeDefinition('console.command.messenger_setup_transports');
437+
$container->removeDefinition('console.command.messenger_failed_messages_retry');
438+
$container->removeDefinition('console.command.messenger_failed_messages_show');
439+
$container->removeDefinition('console.command.messenger_failed_messages_remove');
440+
$container->removeDefinition('cache.messenger.restart_workers_signal');
441+
442+
if ($container->hasDefinition('messenger.transport.amqp.factory') && !class_exists(AmqpTransportFactory::class)) {
443+
if (class_exists(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)) {
444+
$container->getDefinition('messenger.transport.amqp.factory')
445+
->setClass(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)
446+
->addTag('messenger.transport_factory');
447+
} else {
448+
$container->removeDefinition('messenger.transport.amqp.factory');
449+
}
450+
}
451+
452+
if ($container->hasDefinition('messenger.transport.redis.factory') && !class_exists(RedisTransportFactory::class)) {
453+
if (class_exists(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)) {
454+
$container->getDefinition('messenger.transport.redis.factory')
455+
->setClass(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)
456+
->addTag('messenger.transport_factory');
457+
} else {
458+
$container->removeDefinition('messenger.transport.redis.factory');
459+
}
460+
}
461+
}
462+
463+
// notifier depends on messenger, mailer being registered
464+
if ($this->notifierConfigEnabled = $this->isConfigEnabled($container, $config['notifier'])) {
465+
$this->registerNotifierConfiguration($config['notifier'], $container, $loader);
466+
}
467+
468+
// profiler depends on form, validation, translation, messenger, mailer, http-client, notifier being registered
469+
$this->registerProfilerConfiguration($config['profiler'], $container, $loader);
470+
464471
$this->addAnnotatedClassesToCompile([
465472
'**\\Controller\\',
466473
'**\\Entity\\',

‎Tests/DependencyInjection/Fixtures/php/form_default_csrf.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?php
2+
3+
$container->loadFromExtension('framework', [
4+
'form' => [
5+
'legacy_error_messages' => false,
6+
],
7+
'session' => [
8+
'storage_factory_id' => 'session.storage.factory.native',
9+
'handler_id' => null,
10+
],
11+
]);

‎Tests/DependencyInjection/Fixtures/xml/form_default_csrf.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" ?>
2+
3+
<container xmlns="http://symfony.com/schema/dic/services"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xmlns:framework="http://symfony.com/schema/dic/symfony"
6+
xsi:schemaLocation="http://symfony.com/schema/dic/services https://symfony.com/schema/dic/services/services-1.0.xsd
7+
http://symfony.com/schema/dic/symfony https://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
8+
9+
<framework:config>
10+
<framework:form enabled="true" legacy-error-messages="false" />
11+
<framework:session storage-factory-id="session.storage.factory.native" handler-id="null"/>
12+
</framework:config>
13+
</container>

‎Tests/DependencyInjection/Fixtures/yml/form_default_csrf.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
framework:
2+
form:
3+
legacy_error_messages: false
4+
session:
5+
storage_factory_id: session.storage.factory.native
6+
handler_id: null

‎Tests/DependencyInjection/FrameworkExtensionTest.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,18 @@ public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()
159159
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
160160
}
161161

162+
public function testFormsCsrfIsEnabledByDefault()
163+
{
164+
if (class_exists(FullStack::class)) {
165+
$this->markTestSkipped('testing with the FullStack prevents verifying default values');
166+
}
167+
$container = $this->createContainerFromFile('form_default_csrf');
168+
169+
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
170+
$this->assertTrue($container->hasParameter('form.type_extension.csrf.enabled'));
171+
$this->assertTrue($container->getParameter('form.type_extension.csrf.enabled'));
172+
}
173+
162174
public function testHttpMethodOverride()
163175
{
164176
$container = $this->createContainerFromFile('full');

0 commit comments

Comments
 (0)