Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit dcfb493

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
security #cve-2022-xxxx [FrameworkBundle] Enable CSRF in FORM by default (jderusse)
This PR was merged into the 5.3 branch.
2 parents 224eb7d + f0ffb77 commit dcfb493
Copy full SHA for dcfb493

File tree

5 files changed

+108
-59
lines changed
Filter options

5 files changed

+108
-59
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
+66-59Lines changed: 66 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -311,26 +311,6 @@ public function load(array $configs, ContainerBuilder $container)
311311
$this->registerRequestConfiguration($config['request'], $container, $loader);
312312
}
313313

314-
if ($this->isConfigEnabled($container, $config['form'])) {
315-
if (!class_exists(Form::class)) {
316-
throw new LogicException('Form support cannot be enabled as the Form component is not installed. Try running "composer require symfony/form".');
317-
}
318-
319-
$this->formConfigEnabled = true;
320-
$this->registerFormConfiguration($config, $container, $loader);
321-
322-
if (ContainerBuilder::willBeAvailable('symfony/validator', Validation::class, ['symfony/framework-bundle', 'symfony/form'])) {
323-
$config['validation']['enabled'] = true;
324-
} else {
325-
$container->setParameter('validator.translation_domain', 'validators');
326-
327-
$container->removeDefinition('form.type_extension.form.validator');
328-
$container->removeDefinition('form.type_guesser.validator');
329-
}
330-
} else {
331-
$container->removeDefinition('console.command.form_debug');
332-
}
333-
334314
if ($this->isConfigEnabled($container, $config['assets'])) {
335315
if (!class_exists(\Symfony\Component\Asset\Package::class)) {
336316
throw new LogicException('Asset support cannot be enabled as the Asset component is not installed. Try running "composer require symfony/asset".');
@@ -339,39 +319,6 @@ public function load(array $configs, ContainerBuilder $container)
339319
$this->registerAssetsConfiguration($config['assets'], $container, $loader);
340320
}
341321

342-
if ($this->messengerConfigEnabled = $this->isConfigEnabled($container, $config['messenger'])) {
343-
$this->registerMessengerConfiguration($config['messenger'], $container, $loader, $config['validation']);
344-
} else {
345-
$container->removeDefinition('console.command.messenger_consume_messages');
346-
$container->removeDefinition('console.command.messenger_debug');
347-
$container->removeDefinition('console.command.messenger_stop_workers');
348-
$container->removeDefinition('console.command.messenger_setup_transports');
349-
$container->removeDefinition('console.command.messenger_failed_messages_retry');
350-
$container->removeDefinition('console.command.messenger_failed_messages_show');
351-
$container->removeDefinition('console.command.messenger_failed_messages_remove');
352-
$container->removeDefinition('cache.messenger.restart_workers_signal');
353-
354-
if ($container->hasDefinition('messenger.transport.amqp.factory') && !class_exists(AmqpTransportFactory::class)) {
355-
if (class_exists(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)) {
356-
$container->getDefinition('messenger.transport.amqp.factory')
357-
->setClass(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)
358-
->addTag('messenger.transport_factory');
359-
} else {
360-
$container->removeDefinition('messenger.transport.amqp.factory');
361-
}
362-
}
363-
364-
if ($container->hasDefinition('messenger.transport.redis.factory') && !class_exists(RedisTransportFactory::class)) {
365-
if (class_exists(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)) {
366-
$container->getDefinition('messenger.transport.redis.factory')
367-
->setClass(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)
368-
->addTag('messenger.transport_factory');
369-
} else {
370-
$container->removeDefinition('messenger.transport.redis.factory');
371-
}
372-
}
373-
}
374-
375322
if ($this->httpClientConfigEnabled = $this->isConfigEnabled($container, $config['http_client'])) {
376323
$this->registerHttpClientConfiguration($config['http_client'], $container, $loader, $config['profiler']);
377324
}
@@ -380,18 +327,12 @@ public function load(array $configs, ContainerBuilder $container)
380327
$this->registerMailerConfiguration($config['mailer'], $container, $loader);
381328
}
382329

383-
if ($this->notifierConfigEnabled = $this->isConfigEnabled($container, $config['notifier'])) {
384-
$this->registerNotifierConfiguration($config['notifier'], $container, $loader);
385-
}
386-
387330
$propertyInfoEnabled = $this->isConfigEnabled($container, $config['property_info']);
388-
$this->registerValidationConfiguration($config['validation'], $container, $loader, $propertyInfoEnabled);
389331
$this->registerHttpCacheConfiguration($config['http_cache'], $container, $config['http_method_override']);
390332
$this->registerEsiConfiguration($config['esi'], $container, $loader);
391333
$this->registerSsiConfiguration($config['ssi'], $container, $loader);
392334
$this->registerFragmentsConfiguration($config['fragments'], $container, $loader);
393335
$this->registerTranslatorConfiguration($config['translator'], $container, $loader, $config['default_locale']);
394-
$this->registerProfilerConfiguration($config['profiler'], $container, $loader);
395336
$this->registerWorkflowConfiguration($config['workflows'], $container, $loader);
396337
$this->registerDebugConfiguration($config['php_errors'], $container, $loader);
397338
$this->registerRouterConfiguration($config['router'], $container, $loader, $config['translator']['enabled_locales'] ?? []);
@@ -461,6 +402,72 @@ public function load(array $configs, ContainerBuilder $container)
461402
}
462403
$this->registerSecurityCsrfConfiguration($config['csrf_protection'], $container, $loader);
463404

405+
// form depends on csrf being registered
406+
if ($this->isConfigEnabled($container, $config['form'])) {
407+
if (!class_exists(Form::class)) {
408+
throw new LogicException('Form support cannot be enabled as the Form component is not installed. Try running "composer require symfony/form".');
409+
}
410+
411+
$this->formConfigEnabled = true;
412+
$this->registerFormConfiguration($config, $container, $loader);
413+
414+
if (ContainerBuilder::willBeAvailable('symfony/validator', Validation::class, ['symfony/framework-bundle', 'symfony/form'])) {
415+
$config['validation']['enabled'] = true;
416+
} else {
417+
$container->setParameter('validator.translation_domain', 'validators');
418+
419+
$container->removeDefinition('form.type_extension.form.validator');
420+
$container->removeDefinition('form.type_guesser.validator');
421+
}
422+
} else {
423+
$container->removeDefinition('console.command.form_debug');
424+
}
425+
426+
// validation depends on form, annotations being registered
427+
$this->registerValidationConfiguration($config['validation'], $container, $loader, $propertyInfoEnabled);
428+
429+
// messenger depends on validation being registered
430+
if ($this->messengerConfigEnabled = $this->isConfigEnabled($container, $config['messenger'])) {
431+
$this->registerMessengerConfiguration($config['messenger'], $container, $loader, $config['validation']);
432+
} else {
433+
$container->removeDefinition('console.command.messenger_consume_messages');
434+
$container->removeDefinition('console.command.messenger_debug');
435+
$container->removeDefinition('console.command.messenger_stop_workers');
436+
$container->removeDefinition('console.command.messenger_setup_transports');
437+
$container->removeDefinition('console.command.messenger_failed_messages_retry');
438+
$container->removeDefinition('console.command.messenger_failed_messages_show');
439+
$container->removeDefinition('console.command.messenger_failed_messages_remove');
440+
$container->removeDefinition('cache.messenger.restart_workers_signal');
441+
442+
if ($container->hasDefinition('messenger.transport.amqp.factory') && !class_exists(AmqpTransportFactory::class)) {
443+
if (class_exists(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)) {
444+
$container->getDefinition('messenger.transport.amqp.factory')
445+
->setClass(\Symfony\Component\Messenger\Transport\AmqpExt\AmqpTransportFactory::class)
446+
->addTag('messenger.transport_factory');
447+
} else {
448+
$container->removeDefinition('messenger.transport.amqp.factory');
449+
}
450+
}
451+
452+
if ($container->hasDefinition('messenger.transport.redis.factory') && !class_exists(RedisTransportFactory::class)) {
453+
if (class_exists(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)) {
454+
$container->getDefinition('messenger.transport.redis.factory')
455+
->setClass(\Symfony\Component\Messenger\Transport\RedisExt\RedisTransportFactory::class)
456+
->addTag('messenger.transport_factory');
457+
} else {
458+
$container->removeDefinition('messenger.transport.redis.factory');
459+
}
460+
}
461+
}
462+
463+
// notifier depends on messenger, mailer being registered
464+
if ($this->notifierConfigEnabled = $this->isConfigEnabled($container, $config['notifier'])) {
465+
$this->registerNotifierConfiguration($config['notifier'], $container, $loader);
466+
}
467+
468+
// profiler depends on form, validation, translation, messenger, mailer, http-client, notifier being registered
469+
$this->registerProfilerConfiguration($config['profiler'], $container, $loader);
470+
464471
$this->addAnnotatedClassesToCompile([
465472
'**\\Controller\\',
466473
'**\\Entity\\',

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/form_default_csrf.php

Copy file name to clipboard
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?php
2+
3+
$container->loadFromExtension('framework', [
4+
'form' => [
5+
'legacy_error_messages' => false,
6+
],
7+
'session' => [
8+
'storage_factory_id' => 'session.storage.factory.native',
9+
'handler_id' => null,
10+
],
11+
]);

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/form_default_csrf.xml

Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" ?>
2+
3+
<container xmlns="http://symfony.com/schema/dic/services"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xmlns:framework="http://symfony.com/schema/dic/symfony"
6+
xsi:schemaLocation="http://symfony.com/schema/dic/services https://symfony.com/schema/dic/services/services-1.0.xsd
7+
http://symfony.com/schema/dic/symfony https://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
8+
9+
<framework:config>
10+
<framework:form enabled="true" legacy-error-messages="false" />
11+
<framework:session storage-factory-id="session.storage.factory.native" handler-id="null"/>
12+
</framework:config>
13+
</container>

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/form_default_csrf.yml

Copy file name to clipboard
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
framework:
2+
form:
3+
legacy_error_messages: false
4+
session:
5+
storage_factory_id: session.storage.factory.native
6+
handler_id: null

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,18 @@ public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()
159159
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
160160
}
161161

162+
public function testFormsCsrfIsEnabledByDefault()
163+
{
164+
if (class_exists(FullStack::class)) {
165+
$this->markTestSkipped('testing with the FullStack prevents verifying default values');
166+
}
167+
$container = $this->createContainerFromFile('form_default_csrf');
168+
169+
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
170+
$this->assertTrue($container->hasParameter('form.type_extension.csrf.enabled'));
171+
$this->assertTrue($container->getParameter('form.type_extension.csrf.enabled'));
172+
}
173+
162174
public function testHttpMethodOverride()
163175
{
164176
$container = $this->createContainerFromFile('full');

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.