udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSRF hidden field helper

Browse Source
This commit is contained in:
udo
2026-07-13 23:52:49 +00:00
parent 096138d6a1
commit 7fabccd90a
5 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/tests/http.uce
+8
View File
@@ -37,6 +37,8 @@ RENDER(Request& context)
URI port_uri = parse_uri("https://example.test:8443/status");
String generated_session = session_id_create();
String csrf = "";
String csrf_html = "";
String csrf_named_html = "";
String csrf_rotated = "";
bool csrf_ok = false;
bool csrf_bad = false;
@@ -45,6 +47,8 @@ RENDER(Request& context)
if(action != "destroy")
{
csrf = csrf_token("uce-site-tests", "http_form");
csrf_html = csrf_field("uce-site-tests", "http_form");
csrf_named_html = csrf_field("uce-site-tests", "http_form", "csrf_token");
csrf_ok = csrf_valid(csrf, "uce-site-tests", "http_form");
csrf_bad = csrf_valid("not-" + csrf, "uce-site-tests", "http_form");
csrf_rotate("uce-site-tests", "http_form");
@@ -76,7 +80,11 @@ RENDER(Request& context)
check("session_start()", session_id != "", "session_id=" + session_id);
check("session_id_create()", generated_session.length() >= 16, generated_session);
if(action != "destroy")
{
check("csrf_token() / csrf_valid() / csrf_rotate()", csrf.length() >= 32 && csrf_ok && !csrf_bad && !csrf_old_after_rotate && csrf_new_after_rotate, "csrf=" + csrf + " rotated=" + csrf_rotated);
check("csrf_field()", csrf_html == "<input type=\"hidden\" name=\"http_form\" value=\"" + csrf + "\">", csrf_html);
check("csrf_field() custom field name", csrf_named_html == "<input type=\"hidden\" name=\"csrf_token\" value=\"" + csrf + "\">", csrf_named_html);
}
if(action == "destroy")
check("session_destroy()", session_dump.find("suite") == String::npos && context.session_id == "" && context.session_name == "" && !file_exists(session_path), session_dump + " path=" + session_path);