Adding anti-CSRF tokens to Quixote
Neil Schemenauer <[email protected]> Thu, 23 Nov 2017 12:27:01 -0600
| Newsgroups | gmane.comp.web.quixote.user |
|---|---|
| Message-ID | <[email protected]> |
R3JlZXRpbmdzLAoKUXVpeG90ZSBhbHJlYWR5IGhhcyBnb29kIENTUkYgcHJldmVudGlvbiB3aXRo IHRoZSAiZm9ybSB0b2tlbnMiCm1lY2hhbmlzbS4gIEhvd2V2ZXIsIHdoZW4gYnVpbGRpbmcgQUpB WCB0eXBlIGFwcGxpY2F0aW9ucywgSSBoYXZlCmZvdW5kIGl0IGhhbmR5IHRvIHVzZSBhIG1vcmUg dHJhZGl0aW9uYWwgdG9rZW4gYmFzZWQgYXBwcm9hY2ggKG9uZQp1bmlxdWUgdG9rZW4gcGVyIHNl c3Npb24pLiAgSSBob3BlIHRvIGdhdGhlciBzb21lIGZlZWRiYWNrIHNvIHRoYXQKdGhpcyBuZXcg ZmVhdHVyZSBpcyB1c2VmdWwgdG8gb3RoZXJzLgoKUHJvdG90eXBlIGltcGxlbWVudGF0aW9uIChp biBxdWl4b3RlLnNlc3Npb24pOgoKQ1NSRl9UT0tFTl9OQU1FID0gJ2NzcmZfdG9rZW4nCgpjbGFz cyBTZXNzaW9uOgoKICAgIC4uLgoKICAgICMgLS0gQ3Jvc3Mtc2l0ZSByZXF1ZXN0IGZvcmdlcnkg KENTUkYpIHByZXZlbnRpb24gdG9rZW5zIC0tLS0tLS0tLS0tCgogICAgZGVmIGdldF9jc3JmX3Rv a2VuKHNlbGYpOgogICAgICAgICIiIlJldHVybiBhIHJhbmRvbSB0b2tlbiB1bmlxdWUgdG8gdGhl IHNlc3Npb24uICBUaGlzIGlzCiAgICAgICAgc3VpdGFibGUgZm9yIGluY2x1c2lvbiBpbiBmb3Jt cyBhcyBhIGhpZGRlbiBmaWVsZCBpbiBvcmRlcgogICAgICAgIHRvIHByZXZlbnQgQ1NSRiBhdHRh Y2tzLiAgV2hlbiB0aGUgZm9ybSBpcyBzdWJtaXR0ZWQsIHRoZQogICAgICAgIHRva2VuIG11c3Qg YmUgY2hlY2tlZCB1c2luZyBhIGNvbnN0YW50IHRpbWUgY29tcGFyZS4gIFRoZQogICAgICAgIHRv a2VuIHNob3VsZCBub3QgYmUgaW5jbHVkZWQgaW4gR0VUIFVSTHMgYXMgdGhlcmUgaXMgYQogICAg ICAgIGdyZWF0ZXIgcmlzayBvZiBkaXNjbG9zdXJlLiAgVXNpbmcgYSBzZXBhcmF0ZSB0b2tlbiBw cm92aWRlcwogICAgICAgIHNvbWUgc2VjdXJpdHkgYmVuZWZpdHMgb3ZlciByZS11c2luZyB0aGUg c2Vzc2lvbiBJRCBhcyBhCiAgICAgICAgQ1NSRiB0b2tlbi4KICAgICAgICAiIiIKICAgICAgICBp ZiBzZWxmLl9jc3JmX3Rva2VuIGlzIE5vbmU6CiAgICAgICAgICAgIHNlbGYuX2NzcmZfdG9rZW4g PSByYW5kYnl0ZXMoMTYpICMgMTI4LWJpdCByYW5kb20gbnVtYmVyCiAgICAgICAgcmV0dXJuIHNl bGYuX2NzcmZfdG9rZW4KCiAgICBkZWYgdmFsaWRfY3NyZl90b2tlbihzZWxmLCBuYW1lPU5vbmUp OgogICAgICAgICIiIlJldHVybiB0cnVlIGlmIHRoZSByZXF1ZXN0IGNvbnRhaW5zIHRoZSBDU1JG IHRva2VuIGluIHRoZQogICAgICAgIHBhcmFtZXRlciBjYWxsZWQgJ25hbWUnLiAgVGhlIEhUVFAg bWV0aG9kIG11c3QgYmUgUE9TVC4gIElmCiAgICAgICAgJ25hbWUnIGlzIG5vdCBwcm92aWRlZCwg dGhlbiBDU1JGX1RPS0VOX05BTUUgaXMgdXNlZCBhcyB0aGUKICAgICAgICBuYW1lLgogICAgICAg ICIiIgogICAgICAgIGlmIGdldF9yZXF1ZXN0KCkuZ2V0X21ldGhvZCgpICE9ICdQT1NUJzoKICAg ICAgICAgICAgcmV0dXJuIEZhbHNlCiAgICAgICAgdmFsdWUgPSBnZXRfcGFyYW0obmFtZSBvciBD U1JGX1RPS0VOX05BTUUsIE5vbmUpCiAgICAgICAgaWYgbm90IHZhbHVlOgogICAgICAgICAgICBy ZXR1cm4gRmFsc2UKICAgICAgICByZXR1cm4gc2FmZV9zdHJfY21wKHZhbHVlLCBzZWxmLmdldF9j c3JmX3Rva2VuKCkpCgpJbiBxdWl4b3RlLnV0aWw6CgpkZWYgc2FmZV9zdHJfY21wKGEsIGIpOgog ICAgIiIiQSAobW9zdGx5KSBjb25zdGFudCB0aW1lIGNvbXBhcmlzb24gZnVuY3Rpb24gZm9yIHR3 byBzdHJpbmdzLgogICAgUmV0dXJucyBUcnVlIGlmIHRoZSBzdHJpbmdzIGFyZSBlcXVhbC4gIFVz aW5nIGEgY29uc3RhbnQgdGltZQogICAgZnVuY3Rpb24gaXMgbmVjZXNzYXJ5IHRvIHByZXZlbnQg dGltaW5nIGF0dGFja3Mgd2l0aCBjaGVja2luZwogICAgc2VjdXJpdHkgdG9rZW5zIChlLmcuIHBh c3N3b3JkcywgZm9ybSB0b2tlbnMpLiAgVGhlIGFyZ3VtZW50cwogICAgY2FuICdzdHInIG9yICdi eXRlcycgb2JqZWN0IGJ1dCBtaXhlZCB0eXBlcyBhcmUgbm90IGFsbG93ZWQuCiAgICAiIiIKICAg IGlmIG5vdCBpc2luc3RhbmNlKGEsIGJ5dGVzKToKICAgICAgICBhID0gYS5lbmNvZGUoJ3V0Zi04 JykKICAgICAgICBiID0gYi5lbmNvZGUoJ3V0Zi04JykKICAgIHJlc3VsdCA9IDAgaWYgbGVuKGEp ID09IGxlbihiKSBlbHNlIDEKICAgIGZvciB4LCB5IGluIHppcChhLCBiKToKICAgICAgICByZXN1 bHQgfD0geCBeIHkKICAgIHJldHVybiByZXN1bHQgPT0gMAoKClNvbWUgY29uY2VybnM6CgotIFRo aXMgaXMgdmVyeSBtaW5pbWFsIGhlbHAgYXMgdGhlIHByb2dyYW1tZXIgc3RpbGwgaGFzIHRvIGNy ZWF0ZQogIGFuZCBoaWRkZW4gd2lkZ2V0IGFuZCByZW1lbWJlciB0byBjaGVjayB0aGUgUE9TVCB2 YWx1ZS4gIEkgd29uZGVyCiAgaWYgSSBzaG91bGQgYWRkIHN1cHBvcnQgaW4gRm9ybSgpIHRvIGNy ZWF0ZSBhbmQgY2hlY2sgdGhlIENTUkYKICB0b2tlbi4gIEkgbGlrZSB0aGUgImZvcm1fdG9rZW5z IiBtZWNoYW5pc20gaW4gdGhhdCB5b3UgdHVybiBpdCBvbiBpbiB0aGUKICBjb25maWcgYW5kIGFz IGxvbmcgYXMgeW91IHVzZSAiUE9TVCIgYXMgdGhlIGZvcm0gbWV0aG9kLCB5b3UgYXJlIHByb3Rl Y3RlZC4KCi0gQXJlIHRoZXJlIGFueSBvdGhlciBtZXRob2RzIHRoYXQgdmFsaWRfY3NyZl90b2tl bigpIHNob3VsZCBhbGxvdyBvdGhlciB0aGFuCiAgUE9TVD8gIEkgdGhpbmsgb25seSBhbGxvd2lu ZyBQT1NUIGlzIG9rYXkgYXMgaXQgaXQgdHJpdmlhbCB0byB3cml0ZSB5b3VyCiAgb3duIHZhbGlk YXRpb24gZnVuY3Rpb24gaWYgeW91IG5lZWQgc29tZXRoaW5nIGV4b3RpYy4KClJlZ2FyZHMsCgog IE5laWwKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KUXVp eG90ZS11c2VycyBtYWlsaW5nIGxpc3QKUXVpeG90ZS11c2Vyc0BsaXN0cy5xdWl4b3RlLmNhCmh0 dHA6Ly9saXN0cy5xdWl4b3RlLmNhL2NnaS1iaW4vbWFpbG1hbi9saXN0aW5mby9xdWl4b3RlLXVz ZXJzCg==