Skip to content

Commit d341254

Browse files
fabpotfabpot
committed
bug #37047 [SecurityBundle] Only register CSRF protection listener if CSRF is available (wouterj)
This PR was merged into the 5.1 branch. Discussion ---------- [SecurityBundle] Only register CSRF protection listener if CSRF is available | Q | A | ------------- | --- | Branch? | 5.1 | Bug fix? | yes | New feature? | no | Deprecations? | yes | Tickets | Fix #37033 | License | MIT | Doc PR | - I know we're not allowed to add new deprecations in already released versions. However, I don't think anyone is using SecurityBundle's compiler passes except from Symfony itself - so I don't think anyone is affected by this deprecation. The alternatives would be: * Add a new compiler pass in 5.1 that conditionally registers the CSRF listener * Do this exact change in 5.2 and... * accept a `null` argument in the listener for 5.1 * or add this to the `RegisterCsrfTokenClearingLogoutHandlerPass` class in 5.1 Commits ------- 2d738b3 Only register CSRF protection listener if CSRF is available
2 parents 2a9edfa + 2d738b3 commit d341254

File tree

4 files changed

+76
-24
lines changed

4 files changed

+76
-24
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/RegisterCsrfFeaturesPass.php

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler;
13+
14+
use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
15+
use Symfony\Component\DependencyInjection\ContainerBuilder;
16+
use Symfony\Component\DependencyInjection\Reference;
17+
use Symfony\Component\Security\Http\EventListener\CsrfProtectionListener;
18+
use Symfony\Component\Security\Http\EventListener\CsrfTokenClearingLogoutListener;
19+
20+
/**
21+
* @author Christian Flothmann <christian.flothmann@sensiolabs.de>
22+
* @author Wouter de Jong <wouter@wouterj.nl>
23+
*
24+
* @internal
25+
*/
26+
class RegisterCsrfFeaturesPass implements CompilerPassInterface
27+
{
28+
public function process(ContainerBuilder $container)
29+
{
30+
if (!$container->has('security.csrf.token_storage')) {
31+
return;
32+
}
33+
34+
$this->registerCsrfProtectionListener($container);
35+
$this->registerLogoutHandler($container);
36+
}
37+
38+
private function registerCsrfProtectionListener(ContainerBuilder $container)
39+
{
40+
if (!$container->has('security.authenticator.manager')) {
41+
return;
42+
}
43+
44+
$container->register('security.listener.csrf_protection', CsrfProtectionListener::class)
45+
->addArgument(new Reference('security.csrf.token_storage'))
46+
->addTag('kernel.event_subscriber')
47+
->setPublic(false);
48+
}
49+
50+
protected function registerLogoutHandler(ContainerBuilder $container)
51+
{
52+
if (!$container->has('security.logout_listener')) {
53+
return;
54+
}
55+
56+
$csrfTokenStorage = $container->findDefinition('security.csrf.token_storage');
57+
$csrfTokenStorageClass = $container->getParameterBag()->resolveValue($csrfTokenStorage->getClass());
58+
59+
if (!is_subclass_of($csrfTokenStorageClass, 'Symfony\Component\Security\Csrf\TokenStorage\ClearableTokenStorageInterface')) {
60+
return;
61+
}
62+
63+
$container->register('security.logout.listener.csrf_token_clearing', CsrfTokenClearingLogoutListener::class)
64+
->addArgument(new Reference('security.csrf.token_storage'))
65+
->addTag('kernel.event_subscriber')
66+
->setPublic(false);
67+
}
68+
}

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/RegisterCsrfTokenClearingLogoutHandlerPass.php

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,32 +11,21 @@
1111

1212
namespace Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler;
1313

14-
use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
1514
use Symfony\Component\DependencyInjection\ContainerBuilder;
16-
use Symfony\Component\DependencyInjection\Reference;
17-
use Symfony\Component\Security\Http\EventListener\CsrfTokenClearingLogoutListener;
15+
16+
trigger_deprecation('symfony/security-bundle', '5.1', 'The "%s" class is deprecated.', RegisterCsrfTokenClearingLogoutHandlerPass::class);
1817

1918
/**
20-
* @author Christian Flothmann <christian.flothmann@sensiolabs.de>
19+
* @deprecated since symfony/security-bundle 5.1
2120
*/
22-
class RegisterCsrfTokenClearingLogoutHandlerPass implements CompilerPassInterface
21+
class RegisterCsrfTokenClearingLogoutHandlerPass extends RegisterCsrfFeaturesPass
2322
{
2423
public function process(ContainerBuilder $container)
2524
{
26-
if (!$container->has('security.logout_listener') || !$container->has('security.csrf.token_storage')) {
27-
return;
28-
}
29-
30-
$csrfTokenStorage = $container->findDefinition('security.csrf.token_storage');
31-
$csrfTokenStorageClass = $container->getParameterBag()->resolveValue($csrfTokenStorage->getClass());
32-
33-
if (!is_subclass_of($csrfTokenStorageClass, 'Symfony\Component\Security\Csrf\TokenStorage\ClearableTokenStorageInterface')) {
25+
if (!$container->has('security.csrf.token_storage')) {
3426
return;
3527
}
3628

37-
$container->register('security.logout.listener.csrf_token_clearing', CsrfTokenClearingLogoutListener::class)
38-
->addArgument(new Reference('security.csrf.token_storage'))
39-
->addTag('kernel.event_subscriber')
40-
->setPublic(false);
29+
$this->registerLogoutHandler($container);
4130
}
4231
}

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator.xml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,6 @@
6666
<argument type="abstract">stateless firewall keys</argument>
6767
</service>
6868

69-
<service id="security.listener.csrf_protection" class="Symfony\Component\Security\Http\EventListener\CsrfProtectionListener">
70-
<tag name="kernel.event_subscriber" />
71-
<argument type="service" id="security.csrf.token_manager" />
72-
</service>
73-
7469
<service id="security.listener.remember_me"
7570
class="Symfony\Component\Security\Http\EventListener\RememberMeListener"
7671
abstract="true">

‎src/Symfony/Bundle/SecurityBundle/SecurityBundle.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddExpressionLanguageProvidersPass;
1515
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddSecurityVotersPass;
1616
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddSessionDomainConstraintPass;
17-
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\RegisterCsrfTokenClearingLogoutHandlerPass;
17+
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\RegisterCsrfFeaturesPass;
1818
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\RegisterLdapLocatorPass;
1919
use Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\RegisterTokenUsageTrackingPass;
2020
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AnonymousFactory;
@@ -72,7 +72,7 @@ public function build(ContainerBuilder $container)
7272
$container->addCompilerPass(new AddExpressionLanguageProvidersPass());
7373
$container->addCompilerPass(new AddSecurityVotersPass());
7474
$container->addCompilerPass(new AddSessionDomainConstraintPass(), PassConfig::TYPE_BEFORE_REMOVING);
75-
$container->addCompilerPass(new RegisterCsrfTokenClearingLogoutHandlerPass());
75+
$container->addCompilerPass(new RegisterCsrfFeaturesPass());
7676
$container->addCompilerPass(new RegisterTokenUsageTrackingPass(), PassConfig::TYPE_BEFORE_OPTIMIZATION, 200);
7777
$container->addCompilerPass(new RegisterLdapLocatorPass());
7878

0 commit comments

Comments
 (0)