Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use random string not bytes for CSRF token salt #16502

Merged
merged 2 commits into from
May 21, 2022
Merged

Use random string not bytes for CSRF token salt #16502

merged 2 commits into from
May 21, 2022

Conversation

ravage84
Copy link
Member

Since 309c899 the CSRF token generated contained a binary part for the salt, when one had the new setting verifyTokenSource activated.

Like so:
<input type="hidden" name="_csrfToken" autocomplete="off" value="e�7��T���Ä&quot;\�786952664be900ba7c85f37b215b29da5be37b3f"/>
Instead of:
<input type="hidden" name="_csrfToken" autocomplete="off" value="47f3d3fed912070fae3a676b720eceaaa1124b92e21deeb37aa810ebc5193624cd5b13d41523bc500d308ec79722dd2ef8a965548680bfdac669a113de54d308"/>

This broke the CSRF check completely.

With this change, we use a string representation for it.

@ravage84 ravage84 added this to the 3.10.4 milestone May 17, 2022
@ravage84
Copy link
Member Author

Broken job https://github.com/cakephp/cakephp/runs/6473923736?check_suite_focus=true is unrelated:

v ------ -------------------------------------------------------------------- 
  Line   Core/StaticConfigTrait.php (in context of class Cake\Mailer\Email)  
 ------ -------------------------------------------------------------------- 
  220    Static access to instance property Cake\Mailer\Email::$_registry.   
 ------ -------------------------------------------------------------------- 

Error: ] Found 1 error                                                          

 617/617 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%Script phpstan analyse -c phpstan.neon -l 2 src/ handling the phpstan event returned with error code 1
Error: Process completed with exit code 1.

@othercorey
Copy link
Member

Feels like we're missing a test case.

@markstory markstory merged commit c816b3e into 3.x May 21, 2022
@markstory markstory deleted the 3.x-csrf-string-salt branch May 21, 2022 02:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
backport form middleware security session utility
Projects
None yet
Milestone
3.10.4
Development

Successfully merging this pull request may close these issues.
3 participants
@ravage84 @othercorey @markstory