Skip to content

Commit d9c7f06

Browse files
kenjiskenjis
authored
Merge pull request #7630 from kenjis/remove-config-app-CSRF-items-4.4
Remove Config\App Security items
2 parents 1df1034 + 24e9cad commit d9c7f06

File tree

14 files changed

+176
-203
lines changed

14 files changed

+176
-203
lines changed

‎app/Config/App.php‎

Lines changed: 0 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -158,91 +158,6 @@ class App extends BaseConfig
158158
*/
159159
public array $proxyIPs = [];
160160

161-
/**
162-
* --------------------------------------------------------------------------
163-
* CSRF Token Name
164-
* --------------------------------------------------------------------------
165-
*
166-
* The token name.
167-
*
168-
* @deprecated Use `Config\Security` $tokenName property instead of using this property.
169-
*/
170-
public string $CSRFTokenName = 'csrf_test_name';
171-
172-
/**
173-
* --------------------------------------------------------------------------
174-
* CSRF Header Name
175-
* --------------------------------------------------------------------------
176-
*
177-
* The header name.
178-
*
179-
* @deprecated Use `Config\Security` $headerName property instead of using this property.
180-
*/
181-
public string $CSRFHeaderName = 'X-CSRF-TOKEN';
182-
183-
/**
184-
* --------------------------------------------------------------------------
185-
* CSRF Cookie Name
186-
* --------------------------------------------------------------------------
187-
*
188-
* The cookie name.
189-
*
190-
* @deprecated Use `Config\Security` $cookieName property instead of using this property.
191-
*/
192-
public string $CSRFCookieName = 'csrf_cookie_name';
193-
194-
/**
195-
* --------------------------------------------------------------------------
196-
* CSRF Expire
197-
* --------------------------------------------------------------------------
198-
*
199-
* The number in seconds the token should expire.
200-
*
201-
* @deprecated Use `Config\Security` $expire property instead of using this property.
202-
*/
203-
public int $CSRFExpire = 7200;
204-
205-
/**
206-
* --------------------------------------------------------------------------
207-
* CSRF Regenerate
208-
* --------------------------------------------------------------------------
209-
*
210-
* Regenerate token on every submission?
211-
*
212-
* @deprecated Use `Config\Security` $regenerate property instead of using this property.
213-
*/
214-
public bool $CSRFRegenerate = true;
215-
216-
/**
217-
* --------------------------------------------------------------------------
218-
* CSRF Redirect
219-
* --------------------------------------------------------------------------
220-
*
221-
* Redirect to previous page with error on failure?
222-
*
223-
* @deprecated Use `Config\Security` $redirect property instead of using this property.
224-
*/
225-
public bool $CSRFRedirect = false;
226-
227-
/**
228-
* --------------------------------------------------------------------------
229-
* CSRF SameSite
230-
* --------------------------------------------------------------------------
231-
*
232-
* Setting for CSRF SameSite cookie token. Allowed values are:
233-
* - None
234-
* - Lax
235-
* - Strict
236-
* - ''
237-
*
238-
* Defaults to `Lax` as recommended in this link:
239-
*
240-
* @see https://portswigger.net/web-security/csrf/samesite-cookies
241-
*
242-
* @deprecated `Config\Cookie` $samesite property is used.
243-
*/
244-
public string $CSRFSameSite = 'Lax';
245-
246161
/**
247162
* --------------------------------------------------------------------------
248163
* Content Security Policy

‎system/Config/Services.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
use Config\Pager as PagerConfig;
7878
use Config\Paths;
7979
use Config\Routing;
80+
use Config\Security as SecurityConfig;
8081
use Config\Services as AppServices;
8182
use Config\Session as SessionConfig;
8283
use Config\Toolbar as ToolbarConfig;
@@ -627,13 +628,13 @@ public static function router(?RouteCollectionInterface $routes = null, ?Request
627628
*
628629
* @return Security
629630
*/
630-
public static function security(?App $config = null, bool $getShared = true)
631+
public static function security(?SecurityConfig $config = null, bool $getShared = true)
631632
{
632633
if ($getShared) {
633634
return static::getSharedInstance('security', $config);
634635
}
635636

636-
$config ??= config(App::class);
637+
$config ??= config(SecurityConfig::class);
637638

638639
return new Security($config);
639640
}

‎system/Security/Security.php‎

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
use CodeIgniter\I18n\Time;
1919
use CodeIgniter\Security\Exceptions\SecurityException;
2020
use CodeIgniter\Session\Session;
21-
use Config\App;
2221
use Config\Cookie as CookieConfig;
2322
use Config\Security as SecurityConfig;
2423
use Config\Services;
@@ -44,13 +43,17 @@ class Security implements SecurityInterface
4443
* Protection Method for Cross Site Request Forgery protection.
4544
*
4645
* @var string 'cookie' or 'session'
46+
*
47+
* @deprecated 4.4.0 Use $this->config->csrfProtection.
4748
*/
4849
protected $csrfProtection = self::CSRF_PROTECTION_COOKIE;
4950

5051
/**
5152
* CSRF Token Randomization
5253
*
5354
* @var bool
55+
*
56+
* @deprecated 4.4.0 Use $this->config->tokenRandomize.
5457
*/
5558
protected $tokenRandomize = false;
5659

@@ -69,6 +72,8 @@ class Security implements SecurityInterface
6972
* Token name for Cross Site Request Forgery protection.
7073
*
7174
* @var string
75+
*
76+
* @deprecated 4.4.0 Use $this->config->tokenName.
7277
*/
7378
protected $tokenName = 'csrf_token_name';
7479

@@ -78,6 +83,8 @@ class Security implements SecurityInterface
7883
* Header name for Cross Site Request Forgery protection.
7984
*
8085
* @var string
86+
*
87+
* @deprecated 4.4.0 Use $this->config->headerName.
8188
*/
8289
protected $headerName = 'X-CSRF-TOKEN';
8390

@@ -105,6 +112,8 @@ class Security implements SecurityInterface
105112
* Defaults to two hours (in seconds).
106113
*
107114
* @var int
115+
*
116+
* @deprecated 4.4.0 Use $this->config->expires.
108117
*/
109118
protected $expires = 7200;
110119

@@ -114,6 +123,8 @@ class Security implements SecurityInterface
114123
* Regenerate CSRF Token on every request.
115124
*
116125
* @var bool
126+
*
127+
* @deprecated 4.4.0 Use $this->config->regenerate.
117128
*/
118129
protected $regenerate = true;
119130

@@ -123,6 +134,8 @@ class Security implements SecurityInterface
123134
* Redirect to previous page with error on failure.
124135
*
125136
* @var bool
137+
*
138+
* @deprecated 4.4.0 Use $this->config->redirect.
126139
*/
127140
protected $redirect = false;
128141

@@ -163,35 +176,22 @@ class Security implements SecurityInterface
163176
*/
164177
private ?string $hashInCookie = null;
165178

179+
/**
180+
* Security Config
181+
*/
182+
protected SecurityConfig $config;
183+
166184
/**
167185
* Constructor.
168186
*
169187
* Stores our configuration and fires off the init() method to setup
170188
* initial state.
171189
*/
172-
public function __construct(App $config)
190+
public function __construct(SecurityConfig $config)
173191
{
174-
$security = config(SecurityConfig::class);
175-
176-
// Store CSRF-related configurations
177-
if ($security instanceof SecurityConfig) {
178-
$this->csrfProtection = $security->csrfProtection ?? $this->csrfProtection;
179-
$this->tokenName = $security->tokenName ?? $this->tokenName;
180-
$this->headerName = $security->headerName ?? $this->headerName;
181-
$this->regenerate = $security->regenerate ?? $this->regenerate;
182-
$this->redirect = $security->redirect ?? $this->redirect;
183-
$this->rawCookieName = $security->cookieName ?? $this->rawCookieName;
184-
$this->expires = $security->expires ?? $this->expires;
185-
$this->tokenRandomize = $security->tokenRandomize ?? $this->tokenRandomize;
186-
} else {
187-
// `Config/Security.php` is absence
188-
$this->tokenName = $config->CSRFTokenName ?? $this->tokenName;
189-
$this->headerName = $config->CSRFHeaderName ?? $this->headerName;
190-
$this->regenerate = $config->CSRFRegenerate ?? $this->regenerate;
191-
$this->rawCookieName = $config->CSRFCookieName ?? $this->rawCookieName;
192-
$this->expires = $config->CSRFExpire ?? $this->expires;
193-
$this->redirect = $config->CSRFRedirect ?? $this->redirect;
194-
}
192+
$this->config = $config;
193+
194+
$this->rawCookieName = $config->cookieName;
195195

196196
if ($this->isCSRFCookie()) {
197197
$cookie = config(CookieConfig::class);
@@ -213,7 +213,7 @@ public function __construct(App $config)
213213

214214
private function isCSRFCookie(): bool
215215
{
216-
return $this->csrfProtection === self::CSRF_PROTECTION_COOKIE;
216+
return $this->config->csrfProtection === self::CSRF_PROTECTION_COOKIE;
217217
}
218218

219219
private function configureSession(): void
@@ -287,7 +287,7 @@ public function verify(RequestInterface $request)
287287
$postedToken = $this->getPostedToken($request);
288288

289289
try {
290-
$token = ($postedToken !== null && $this->tokenRandomize)
290+
$token = ($postedToken !== null && $this->config->tokenRandomize)
291291
? $this->derandomize($postedToken) : $postedToken;
292292
} catch (InvalidArgumentException $e) {
293293
$token = null;
@@ -300,7 +300,7 @@ public function verify(RequestInterface $request)
300300

301301
$this->removeTokenInRequest($request);
302302

303-
if ($this->regenerate) {
303+
if ($this->config->regenerate) {
304304
$this->generateHash();
305305
}
306306

@@ -318,13 +318,13 @@ private function removeTokenInRequest(RequestInterface $request): void
318318

319319
$json = json_decode($request->getBody() ?? '');
320320

321-
if (isset($_POST[$this->tokenName])) {
321+
if (isset($_POST[$this->config->tokenName])) {
322322
// We kill this since we're done and we don't want to pollute the POST array.
323-
unset($_POST[$this->tokenName]);
323+
unset($_POST[$this->config->tokenName]);
324324
$request->setGlobal('post', $_POST);
325-
} elseif (isset($json->{$this->tokenName})) {
325+
} elseif (isset($json->{$this->config->tokenName})) {
326326
// We kill this since we're done and we don't want to pollute the JSON data.
327-
unset($json->{$this->tokenName});
327+
unset($json->{$this->config->tokenName});
328328
$request->setBody(json_encode($json));
329329
}
330330
}
@@ -335,19 +335,19 @@ private function getPostedToken(RequestInterface $request): ?string
335335

336336
// Does the token exist in POST, HEADER or optionally php:://input - json data.
337337

338-
if ($tokenValue = $request->getPost($this->tokenName)) {
338+
if ($tokenValue = $request->getPost($this->config->tokenName)) {
339339
return $tokenValue;
340340
}
341341

342-
if ($request->hasHeader($this->headerName) && ! empty($request->header($this->headerName)->getValue())) {
343-
return $request->header($this->headerName)->getValue();
342+
if ($request->hasHeader($this->config->headerName) && ! empty($request->header($this->config->headerName)->getValue())) {
343+
return $request->header($this->config->headerName)->getValue();
344344
}
345345

346346
$body = (string) $request->getBody();
347347
$json = json_decode($body);
348348

349349
if ($body !== '' && ! empty($json) && json_last_error() === JSON_ERROR_NONE) {
350-
return $json->{$this->tokenName} ?? null;
350+
return $json->{$this->config->tokenName} ?? null;
351351
}
352352

353353
return null;
@@ -358,7 +358,7 @@ private function getPostedToken(RequestInterface $request): ?string
358358
*/
359359
public function getHash(): ?string
360360
{
361-
return $this->tokenRandomize ? $this->randomize($this->hash) : $this->hash;
361+
return $this->config->tokenRandomize ? $this->randomize($this->hash) : $this->hash;
362362
}
363363

364364
/**
@@ -407,23 +407,23 @@ protected function derandomize(string $token): string
407407
*/
408408
public function getTokenName(): string
409409
{
410-
return $this->tokenName;
410+
return $this->config->tokenName;
411411
}
412412

413413
/**
414414
* Returns the CSRF Header Name.
415415
*/
416416
public function getHeaderName(): string
417417
{
418-
return $this->headerName;
418+
return $this->config->headerName;
419419
}
420420

421421
/**
422422
* Returns the CSRF Cookie Name.
423423
*/
424424
public function getCookieName(): string
425425
{
426-
return $this->cookieName;
426+
return $this->config->cookieName;
427427
}
428428

429429
/**
@@ -443,7 +443,7 @@ public function isExpired(): bool
443443
*/
444444
public function shouldRedirect(): bool
445445
{
446-
return $this->redirect;
446+
return $this->config->redirect;
447447
}
448448

449449
/**
@@ -521,9 +521,9 @@ private function restoreHash(): void
521521
if ($this->isHashInCookie()) {
522522
$this->hash = $this->hashInCookie;
523523
}
524-
} elseif ($this->session->has($this->tokenName)) {
524+
} elseif ($this->session->has($this->config->tokenName)) {
525525
// Session based CSRF protection
526-
$this->hash = $this->session->get($this->tokenName);
526+
$this->hash = $this->session->get($this->config->tokenName);
527527
}
528528
}
529529

@@ -562,7 +562,7 @@ private function saveHashInCookie(): void
562562
$this->rawCookieName,
563563
$this->hash,
564564
[
565-
'expires' => $this->expires === 0 ? 0 : Time::now()->getTimestamp() + $this->expires,
565+
'expires' => $this->config->expires === 0 ? 0 : Time::now()->getTimestamp() + $this->config->expires,
566566
]
567567
);
568568

@@ -606,6 +606,6 @@ protected function doSendCookie(): void
606606

607607
private function saveHashInSession(): void
608608
{
609-
$this->session->set($this->tokenName, $this->hash);
609+
$this->session->set($this->config->tokenName, $this->hash);
610610
}
611611
}

‎system/Test/Mock/MockAppConfig.php‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,6 @@ class MockAppConfig extends App
1818
public string $baseURL = 'http://example.com/';
1919
public string $uriProtocol = 'REQUEST_URI';
2020
public array $proxyIPs = [];
21-
public string $CSRFTokenName = 'csrf_test_name';
22-
public string $CSRFHeaderName = 'X-CSRF-TOKEN';
23-
public string $CSRFCookieName = 'csrf_cookie_name';
24-
public int $CSRFExpire = 7200;
25-
public bool $CSRFRegenerate = true;
26-
public array $CSRFExcludeURIs = ['http://example.com'];
27-
public bool $CSRFRedirect = false;
28-
public string $CSRFSameSite = 'Lax';
2921
public bool $CSPEnabled = false;
3022
public string $defaultLocale = 'en';
3123
public bool $negotiateLocale = false;

0 commit comments

Comments
 (0)