udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add native csrf helpers

Browse Source
This commit is contained in:
udo
2026-07-06 09:58:25 +00:00
parent 125a24e2f9
commit b8c2efe976
7 changed files with 129 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/tests/http.uce
+18
View File
@@ -34,6 +34,22 @@ RENDER(Request& context)
String malformed_percent = uri_decode("% %A %GG ok%20done");
URI empty_uri = parse_uri("");
String generated_session = session_id_create();
String csrf = "";
String csrf_rotated = "";
bool csrf_ok = false;
bool csrf_bad = false;
bool csrf_old_after_rotate = false;
bool csrf_new_after_rotate = false;
if(action != "destroy")
{
csrf = csrf_token("uce-site-tests", "http_form");
csrf_ok = csrf_valid(csrf, "uce-site-tests", "http_form");
csrf_bad = csrf_valid("not-" + csrf, "uce-site-tests", "http_form");
csrf_rotate("uce-site-tests", "http_form");
csrf_old_after_rotate = csrf_valid(csrf, "uce-site-tests", "http_form");
csrf_rotated = csrf_token("uce-site-tests", "http_form");
csrf_new_after_rotate = csrf_rotated != "" && csrf_rotated != csrf && csrf_valid(csrf_rotated, "uce-site-tests", "http_form");
}
String query_dump = var_dump(query);
String set_cookie_dump = var_dump(context.set_cookies);
String header_dump = var_dump(context.header);
@@ -55,6 +71,8 @@ RENDER(Request& context)
check("response header mutation", context.header["X-Site-Tests"] == "http-suite", header_dump);
check("session_start()", session_id != "", "session_id=" + session_id);
check("session_id_create()", generated_session.length() >= 16, generated_session);
if(action != "destroy")
check("csrf_token() / csrf_valid() / csrf_rotate()", csrf.length() >= 32 && csrf_ok && !csrf_bad && !csrf_old_after_rotate && csrf_new_after_rotate, "csrf=" + csrf + " rotated=" + csrf_rotated);
if(action == "destroy")
check("session_destroy()", session_dump.find("suite") == String::npos && context.session_id == "" && context.session_name == "" && !file_exists(session_path), session_dump + " path=" + session_path);