From 0bb6f60cde755c6b0ba7e69f7050a95a4f7cc36e Mon Sep 17 00:00:00 2001 From: Caen De Silva Date: Mon, 13 Nov 2023 11:24:30 +0100 Subject: [PATCH] Add CSRF token security to realtime compiler dashboard --- .../resources/dashboard.blade.php | 5 +++ .../src/Http/BaseController.php | 43 +++++++++++++++++++ .../src/Http/DashboardController.php | 2 +- 3 files changed, 49 insertions(+), 1 deletion(-) diff --git a/packages/realtime-compiler/resources/dashboard.blade.php b/packages/realtime-compiler/resources/dashboard.blade.php index 318e9f70b55..fbbce0bcc8b 100644 --- a/packages/realtime-compiler/resources/dashboard.blade.php +++ b/packages/realtime-compiler/resources/dashboard.blade.php @@ -4,6 +4,7 @@ + {{ $title }} @@ -64,6 +65,7 @@

Site Pages & Routes

@if($dashboard->isInteractive())
+
@@ -136,6 +138,7 @@
+
@@ -242,6 +245,7 @@
@if($dashboard->isInteractive()) + @@ -302,6 +306,7 @@ @if($dashboard->isInteractive())
+ diff --git a/packages/realtime-compiler/src/Http/BaseController.php b/packages/realtime-compiler/src/Http/BaseController.php index 862453922ea..12ef50250a4 100644 --- a/packages/realtime-compiler/src/Http/BaseController.php +++ b/packages/realtime-compiler/src/Http/BaseController.php @@ -4,6 +4,7 @@ namespace Hyde\RealtimeCompiler\Http; +use BadMethodCallException; use Desilva\Microserve\Request; use Desilva\Microserve\Response; use Desilva\Microserve\JsonResponse; @@ -76,6 +77,14 @@ protected function authorizePostRequest(): void if (! $this->isRequestMadeFromLocalhost()) { throw new HttpException(403, "Refusing to serve request from address {$_SERVER['REMOTE_ADDR']} (must be on localhost)"); } + + if ($this->withSession) { + if (! $this->validateCSRFToken($this->request->get('_token'))) { + throw new HttpException(403, 'Invalid CSRF token'); + } else { + $this->expireCSRFToken(); + } + } } protected function isRequestMadeFromLocalhost(): bool @@ -91,6 +100,40 @@ protected function isRequestMadeFromLocalhost(): bool return in_array($requestIp, $allowedIps, true); } + protected function generateCSRFToken(): string { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + if (empty($_SESSION['csrf_token'])) { + $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); + } + + return $_SESSION['csrf_token']; + } + + protected function validateCSRFToken(?string $suppliedToken): bool + { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + if ($suppliedToken === null) { + return false; + } + + return ! empty($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $suppliedToken); + } + + protected function expireCSRFToken(): void + { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + unset($_SESSION['csrf_token']); + } + protected function writeToConsole(string $message, string $context = 'dashboard'): void { if (isset($this->console)) { diff --git a/packages/realtime-compiler/src/Http/DashboardController.php b/packages/realtime-compiler/src/Http/DashboardController.php index 7c67d54d64a..84fa92ab6b7 100644 --- a/packages/realtime-compiler/src/Http/DashboardController.php +++ b/packages/realtime-compiler/src/Http/DashboardController.php @@ -93,7 +93,7 @@ public function handle(): Response protected function show(): string { return AnonymousViewCompiler::handle(__DIR__.'/../../resources/dashboard.blade.php', array_merge( - (array) $this, ['dashboard' => $this, 'request' => $this->request], + (array) $this, ['dashboard' => $this, 'request' => $this->request, 'csrfToken' => $this->generateCSRFToken()], )); }