This commit is contained in:
Constantin Simonis 2025-01-29 19:07:31 +01:00
parent 77ba8687a6
commit b28d962a28
Signed by: csimonis
GPG Key ID: 3878FF77C24AF4D2
6 changed files with 145 additions and 109 deletions

View File

@ -1,2 +1,2 @@
import './bootstrap.js'; import "./bootstrap.js";
import './styles/app.css'; import "./styles/app.css";

2
assets/bootstrap.js vendored
View File

@ -1,3 +1,3 @@
import { startStimulusApp } from '@symfony/stimulus-bundle'; import { startStimulusApp } from "@symfony/stimulus-bundle";
const app = startStimulusApp(); const app = startStimulusApp();

View File

@ -2,13 +2,17 @@ const nameCheck = /^[-_a-zA-Z0-9]{4,22}$/;
const tokenCheck = /^[-_\/+a-zA-Z0-9]{24,}$/; const tokenCheck = /^[-_\/+a-zA-Z0-9]{24,}$/;
// Generate and double-submit a CSRF token in a form field and a cookie, as defined by Symfony's SameOriginCsrfTokenManager // Generate and double-submit a CSRF token in a form field and a cookie, as defined by Symfony's SameOriginCsrfTokenManager
document.addEventListener('submit', function (event) { document.addEventListener(
"submit",
function (event) {
generateCsrfToken(event.target); generateCsrfToken(event.target);
}, true); },
true,
);
// When @hotwired/turbo handles form submissions, send the CSRF token in a header in addition to a cookie // When @hotwired/turbo handles form submissions, send the CSRF token in a header in addition to a cookie
// The `framework.csrf_protection.check_header` config option needs to be enabled for the header to be checked // The `framework.csrf_protection.check_header` config option needs to be enabled for the header to be checked
document.addEventListener('turbo:submit-start', function (event) { document.addEventListener("turbo:submit-start", function (event) {
const h = generateCsrfHeaders(event.detail.formSubmission.formElement); const h = generateCsrfHeaders(event.detail.formSubmission.formElement);
Object.keys(h).map(function (k) { Object.keys(h).map(function (k) {
event.detail.formSubmission.fetchRequest.headers[k] = h[k]; event.detail.formSubmission.fetchRequest.headers[k] = h[k];
@ -16,41 +20,64 @@ document.addEventListener('turbo:submit-start', function (event) {
}); });
// When @hotwired/turbo handles form submissions, remove the CSRF cookie once a form has been submitted // When @hotwired/turbo handles form submissions, remove the CSRF cookie once a form has been submitted
document.addEventListener('turbo:submit-end', function (event) { document.addEventListener("turbo:submit-end", function (event) {
removeCsrfToken(event.detail.formSubmission.formElement); removeCsrfToken(event.detail.formSubmission.formElement);
}); });
export function generateCsrfToken(formElement) { export function generateCsrfToken(formElement) {
const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]'); const csrfField = formElement.querySelector(
'input[data-controller="csrf-protection"], input[name="_csrf_token"]',
);
if (!csrfField) { if (!csrfField) {
return; return;
} }
let csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value'); let csrfCookie = csrfField.getAttribute("data-csrf-protection-cookie-value");
let csrfToken = csrfField.value; let csrfToken = csrfField.value;
if (!csrfCookie && nameCheck.test(csrfToken)) { if (!csrfCookie && nameCheck.test(csrfToken)) {
csrfField.setAttribute('data-csrf-protection-cookie-value', csrfCookie = csrfToken); csrfField.setAttribute(
csrfField.defaultValue = csrfToken = btoa(String.fromCharCode.apply(null, (window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18)))); "data-csrf-protection-cookie-value",
csrfField.dispatchEvent(new Event('change', { bubbles: true })); (csrfCookie = csrfToken),
);
csrfField.defaultValue = csrfToken = btoa(
String.fromCharCode.apply(
null,
(window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18)),
),
);
csrfField.dispatchEvent(new Event("change", { bubbles: true }));
} }
if (csrfCookie && tokenCheck.test(csrfToken)) { if (csrfCookie && tokenCheck.test(csrfToken)) {
const cookie = csrfCookie + '_' + csrfToken + '=' + csrfCookie + '; path=/; samesite=strict'; const cookie =
document.cookie = window.location.protocol === 'https:' ? '__Host-' + cookie + '; secure' : cookie; csrfCookie +
"_" +
csrfToken +
"=" +
csrfCookie +
"; path=/; samesite=strict";
document.cookie =
window.location.protocol === "https:"
? "__Host-" + cookie + "; secure"
: cookie;
} }
} }
export function generateCsrfHeaders(formElement) { export function generateCsrfHeaders(formElement) {
const headers = {}; const headers = {};
const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]'); const csrfField = formElement.querySelector(
'input[data-controller="csrf-protection"], input[name="_csrf_token"]',
);
if (!csrfField) { if (!csrfField) {
return headers; return headers;
} }
const csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value'); const csrfCookie = csrfField.getAttribute(
"data-csrf-protection-cookie-value",
);
if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) { if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
headers[csrfCookie] = csrfField.value; headers[csrfCookie] = csrfField.value;
@ -60,20 +87,31 @@ export function generateCsrfHeaders (formElement) {
} }
export function removeCsrfToken(formElement) { export function removeCsrfToken(formElement) {
const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]'); const csrfField = formElement.querySelector(
'input[data-controller="csrf-protection"], input[name="_csrf_token"]',
);
if (!csrfField) { if (!csrfField) {
return; return;
} }
const csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value'); const csrfCookie = csrfField.getAttribute(
"data-csrf-protection-cookie-value",
);
if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) { if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
const cookie = csrfCookie + '_' + csrfField.value + '=0; path=/; samesite=strict; max-age=0'; const cookie =
csrfCookie +
"_" +
csrfField.value +
"=0; path=/; samesite=strict; max-age=0";
document.cookie = window.location.protocol === 'https:' ? '__Host-' + cookie + '; secure' : cookie; document.cookie =
window.location.protocol === "https:"
? "__Host-" + cookie + "; secure"
: cookie;
} }
} }
/* stimulusFetch: 'lazy' */ /* stimulusFetch: 'lazy' */
export default 'csrf-protection-controller'; export default "csrf-protection-controller";

View File

@ -1,54 +1,53 @@
import { Controller } from "@hotwired/stimulus"; import { Controller } from "@hotwired/stimulus";
export default class extends Controller { export default class extends Controller {
addEntry(event) { addEntry(event) {
event.preventDefault(); event.preventDefault();
const formClone = this.element.querySelector('form').cloneNode(true); const formClone = this.element.querySelector("form").cloneNode(true);
formClone.querySelectorAll("select").forEach(input => { formClone.querySelectorAll("select").forEach((input) => {
input.value = "1"; input.value = "1";
}); });
formClone.querySelector('input').value = ''; formClone.querySelector("input").value = "";
this.element.querySelector('.forms').appendChild(formClone); this.element.querySelector(".forms").appendChild(formClone);
} }
removeEntry(event) { removeEntry(event) {
event.preventDefault(); event.preventDefault();
if (document.querySelector('.forms').childElementCount === 1) { if (document.querySelector(".forms").childElementCount === 1) {
return; return;
} }
event.target.closest('form').remove(); event.target.closest("form").remove();
} }
submit(event) { submit(event) {
event.preventDefault(); event.preventDefault();
const forms = document.querySelectorAll('form'); const forms = document.querySelectorAll("form");
const formData = this.getFormData(forms); const formData = this.getFormData(forms);
fetch('/ticket/submit', { fetch("/ticket/submit", {
method: 'POST', method: "POST",
body: JSON.stringify(formData), body: JSON.stringify(formData),
headers: { headers: {
'Content-Type': 'application/json' "Content-Type": "application/json",
} },
}).then(response => { }).then((response) => {
if (!response.ok) { if (!response.ok) {
alert('An error occurred'); alert("An error occurred");
} }
}); });
} }
getFormData(forms) { getFormData(forms) {
const formData = []; const formData = [];
forms.forEach(form => { forms.forEach((form) => {
formData.push(Object.fromEntries(new FormData(form).entries())); formData.push(Object.fromEntries(new FormData(form).entries()));
}) });
return formData; return formData;
} }

View File

@ -1,4 +1,3 @@
@tailwind base; @tailwind base;
@tailwind components; @tailwind components;
@tailwind utilities; @tailwind utilities;