Enable CSRF protection by default

Author: hlecorche

doc/upgrade/3.0.md

@@ -161,6 +161,10 @@
     * [Création d'un formulaire de recherche](../crud.md#ajout-formulaire-de-recherche-facultatif)
     * [Options du formulaire de recherche](../references/searcher.md)
     * [Personnalisation avancée de la classe Searcher](../cookbook/advanced-searcher.md)
+* La protection CSRF est maintenant activée sur le formulaire de recherche (`FormSearchType`). Le jeton CSRF est
+  automatiquement rendu par la fonction Twig `crud_search_form_start`. Si vous surchargez le bloc Twig
+  `search_form_start` ou si vous n'utilisez pas cette fonction Twig, vous devez rendre vous-même le champ `_token`
+  du formulaire.
 
 
 
@@ -254,6 +258,8 @@ Si vous utilisez l'une de ces classes, voici la migration à effectuer :
     * Ajout de l'option requise `reset_settings_url`.
     * L'option `resultsPerPageChoices` est renommée en `results_per_page_choices`.
     * L'option `columnsChoices` est renommée en `columns_choices`.
+    * La protection CSRF est maintenant activée. Le jeton CSRF est automatiquement rendu par le thème Twig
+      (via `form_end`).
 
 
 

src/Form/Type/DisplaySettingsType.php

@@ -70,10 +70,6 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
 
     public function configureOptions(OptionsResolver $resolver): void
     {
-        $resolver->setDefaults([
-            'csrf_protection' => false,
-        ]);
-
         $resolver->setRequired([
             'results_per_page_choices',
             'columns_choices',

src/Form/Type/FormSearchType.php

@@ -27,7 +27,6 @@ public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->setDefaults([
             'data_class' => 'Ecommit\CrudBundle\Form\Searcher\SearcherInterface',
-            'csrf_protection' => false,
         ]);
     }
 

templates/Theme/base.html.twig

@@ -232,6 +232,10 @@
         {% set form_attr = form_attr|merge({novalidate: 'novalidate'}) %}
     {% endif %}
     {{ form_start(crud.searchForm, {'attr': form_attr}) }}
+    {# The CSRF token is rendered here because templates may close the form with a raw "</form>" tag (without form_end) #}
+    {% if crud.searchForm._token is defined %}
+        {{ form_widget(crud.searchForm._token) }}
+    {% endif %}
 {% endapply %}
 {% endblock %}
 

tests/Crud/AbstractCrudTestCase.php

@@ -24,13 +24,21 @@
 use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpFoundation\Session\Session;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 
 abstract class AbstractCrudTestCase extends KernelTestCase
 {
     protected function setUp(): void
     {
         self::bootKernel();
+
+        // The real form factory renders the CSRF token using the real "request_stack" service.
+        // Push a request with a session so CSRF token generation does not fail.
+        $realRequest = new Request();
+        $realRequest->setSession(new Session(new MockArraySessionStorage()));
+        static::getContainer()->get('request_stack')->push($realRequest);
     }
 
     protected function createCrud(array|CrudConfig $crudConfig, array $filters = [], mixed $sessionValue = null): Crud

tests/Form/Filter/AbstractFilterTestCase.php

@@ -28,7 +28,9 @@
 use Symfony\Component\Form\FormView;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpFoundation\Session\Session;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 
 abstract class AbstractFilterTestCase extends KernelTestCase
 {
@@ -54,6 +56,12 @@ protected function setUp(): void
         $this->em = static::getContainer()->get(ManagerRegistry::class)->getManager();
         $this->factory = static::getContainer()->get(FormFactoryInterface::class);
 
+        // The real form factory renders the CSRF token using the real "request_stack" service.
+        // Push a request with a session so CSRF token generation does not fail.
+        $realRequest = new Request();
+        $realRequest->setSession(new Session(new MockArraySessionStorage()));
+        static::getContainer()->get('request_stack')->push($realRequest);
+
         $session = $this->createMock(SessionInterface::class);
         $session->expects($this->any())
             ->method('get')

tests/Twig/CrudExtensionTest.php

@@ -23,6 +23,9 @@
 use Symfony\Component\Form\Extension\Core\Type\FormType;
 use Symfony\Component\Form\FormFactoryInterface;
 use Symfony\Component\Form\FormView;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 use Symfony\Component\OptionsResolver\Exception\UndefinedOptionsException;
 use Twig\Environment;
 use Twig\Markup;
@@ -51,6 +54,12 @@ protected function setUp(): void
         $this->crudExtension = self::getContainer()->get('ecommit_crud.twig.crud_extension');
         $this->formFactory = self::getContainer()->get(FormFactoryInterface::class);
         $this->environment = self::getContainer()->get(Environment::class);
+
+        // The real form factory renders the CSRF token using the real "request_stack" service.
+        // Push a request with a session so CSRF token generation does not fail.
+        $realRequest = new Request();
+        $realRequest->setSession(new Session(new MockArraySessionStorage()));
+        self::getContainer()->get('request_stack')->push($realRequest);
     }
 
     public function testFormStartAjax(): void