Attachment 124932 Details for Bug 22990 – Bug 22990: Add xt/find-missing-csrf.t

[patch] Bug 22990: Add xt/find-missing-csrf.t

Bug-22990-Add-xtfind-missing-csrft.patch (text/plain), 2.99 KB, created by Martin Renvoize (ashimema) on 2021-09-16 13:56:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2021-09-16 13:56:53 UTC

Size: 2.99 KB

patch

obsolete

>From 6991ad6ec70bf0dc14bb767866af6f89f31cb1b3 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Wed, 16 Jun 2021 11:04:42 +0100
>Subject: [PATCH] Bug 22990: Add xt/find-missing-csrf.t
>
>---
> xt/find-missing-csrf.t | 82 ++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 82 insertions(+)
> create mode 100755 xt/find-missing-csrf.t
>
>diff --git a/xt/find-missing-csrf.t b/xt/find-missing-csrf.t
>new file mode 100755
>index 0000000000..14e1d09f44
>--- /dev/null
>+++ b/xt/find-missing-csrf.t
>@@ -0,0 +1,82 @@
>+#!/usr/bin/perl
>+
>+# This file is part of Koha.
>+#
>+# Koha is free software; you can redistribute it and/or modify it
>+# under the terms of the GNU General Public License as published by
>+# the Free Software Foundation; either version 3 of the License, or
>+# (at your option) any later version.
>+#
>+# Koha is distributed in the hope that it will be useful, but
>+# WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU General Public License for more details.
>+#
>+# You should have received a copy of the GNU General Public License
>+# along with Koha; if not, see <http://www.gnu.org/licenses>.
>+
>+use Modern::Perl;
>+use Test::More tests => 1;
>+use File::Find;
>+use File::Slurp;
>+use Data::Dumper;
>+
>+my @themes;
>+
>+# OPAC themes
>+my $opac_dir  = 'koha-tmpl/opac-tmpl';
>+opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) {
>+    push @themes, "$opac_dir/$theme/en";
>+}
>+close $dh;
>+
>+# STAFF themes
>+my $staff_dir = 'koha-tmpl/intranet-tmpl';
>+opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) {
>+    push @themes, "$staff_dir/$theme/en";
>+}
>+close $dh;
>+
>+my @files;
>+sub wanted {
>+    my $name = $File::Find::name;
>+    push @files, $name
>+        if $name =~ m[\.(tt|inc)$] and -f $name;
>+}
>+
>+find({ wanted => \&wanted, no_chdir => 1 }, @themes );
>+
>+my @errors;
>+for my $file ( @files ) {
>+    my @e = check_csrf_in_forms($file);
>+    push @errors, { file => $file, errors => \@e } if @e;
>+}
>+
>+is( @errors, 0, "Template variables should be correctly escaped" )
>+    or diag(Dumper @errors);
>+
>+sub check_csrf_in_forms {
>+    my ( $file ) = @_;
>+
>+    my @lines = read_file($file);
>+    my @errors;
>+    return @errors unless grep { $_ =~ m|<form| } @lines;
>+    my ( $open, $found, $closed ) = ( 0, 0, 0 );
>+    my $line = 0 ;
>+    for my $l (@lines) {
>+        $line++;
>+        $open = $line if ( $l =~ m{<form} && !($l =~ m{method=('|")get('|")}));
>+        $found++  if ($l =~ m|csrf\-token\.inc| && $open);
>+        $closed++ if ($l =~ m|</form| && $open);
>+        if ( $open && $closed ) {
>+            push @errors, "The <form> starting on line $open is missing it's corresponding csrf_token include (see bug 22990)"
>+              if !$found;
>+
>+            # reset
>+            ( $open, $found, $closed ) = ( 0, 0, 0 );
>+        }
>+    }
>+    return @errors;
>+}
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044