Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

data-method whitelist to block adding CSRF #403

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

data-method whitelist to block adding CSRF #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ca07d01
data-method whitelist to block adding CSRF
bwillis Feb 16, 2015
e2cd047
Fixing indentation
bwillis Feb 16, 2015
d7ada5e
Changing configured href matching to domains
bwillis Feb 16, 2015
3cfe37b
Updating the tests to use more secure whitelist
bwillis Feb 18, 2015
4866d8a
Avoid using string construction when setting html attributes
bwillis Feb 18, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 18 additions & 6 deletions src/rails.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,9 @@
// Button onClick disable selector with possible reenable after remote submission
buttonDisableSelector: 'button[data-remote][data-disable-with], button[data-remote][data-disable]',

// Whitelisted domains when using data-method='post' usages
csrfWhitelistedDomains: null,

// Make sure that every Ajax request sends the CSRF token
CSRFProtection: function(xhr) {
var token = $('meta[name="csrf-token"]').attr('content');
Expand Down Expand Up @@ -173,18 +176,22 @@
var href = rails.href(link),
method = link.data('method'),
target = link.attr('target'),
domain = link[0].hostname,
csrfToken = $('meta[name=csrf-token]').attr('content'),
csrfParam = $('meta[name=csrf-param]').attr('content'),
form = $('<form method="post" action="' + href + '"></form>'),
metadataInput = '<input name="_method" value="' + method + '" type="hidden" />';

if (csrfParam !== undefined && csrfToken !== undefined) {
metadataInput += '<input name="' + csrfParam + '" value="' + csrfToken + '" type="hidden" />';
form = $('<form method="post"></form>').attr('action', href),
methodInput = $('<input name="_method" type="hidden" />').attr('value', method);

if (rails.isCsrfDomainWhitelisted(domain) && csrfParam !== undefined && csrfToken !== undefined) {
csrfInput = $('<input type="hidden" />')
.attr('name', csrfParam)
.attr('value', csrfToken);
form.append(csrfInput);
}

if (target) { form.attr('target', target); }

form.hide().append(metadataInput).appendTo('body');
form.hide().append(methodInput).appendTo('body');
form.submit();
},

Expand Down Expand Up @@ -258,6 +265,11 @@
return answer && callback;
},

// Verify, when configured, that the href passes the whitelist and should send the CSRF token.
isCsrfDomainWhitelisted: function(domain){
return rails.csrfWhitelistedDomains ? rails.csrfWhitelistedDomains.test(domain) : true;
},

// Helper function which checks for blank inputs in a form that match the specified CSS selector
blankInputs: function(form, specifiedSelector, nonBlank) {
var inputs = $(), input, valueToCheck,
Expand Down
25 changes: 25 additions & 0 deletions test/public/test/data-method.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,31 @@ asyncTest('link with "data-method" and CSRF', 1, function() {
});
});

asyncTest('whitelisted links with "data-method" get CSRF', 1, function() {
$.rails.csrfWhitelistedDomains = /^localhost$/

$('#qunit-fixture')
.append('<meta name="csrf-param" content="authenticity_token"/>')
.append('<meta name="csrf-token" content="cf50faa3fe97702ca1ae"/>');

submit(function(data) {
strictEqual(data.params.authenticity_token, 'cf50faa3fe97702ca1ae');
});
});

asyncTest('non whitelisted links with "data-method" get no CSRF', 2, function() {
$.rails.csrfWhitelistedDomains = /^rubyonrails.org$/

$('#qunit-fixture')
.append('<meta name="csrf-param" content="authenticity_token"/>')
.append('<meta name="csrf-token" content="cf50faa3fe97702ca1ae"/>');

submit(function(data) {
strictEqual(data.params.authenticity_token, undefined);
strictEqual(data.HTTP_X_CSRF_TOKEN, undefined);
});
});

asyncTest('link "target" should be carried over to generated form', 1, function() {
$('a[data-method]').attr('target', 'super-special-frame');
submit(function(data) {
Expand Down