This is an automated email from the ASF dual-hosted git repository.

schultz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/master by this push:
     new 707e194  Allow customization of the CSRF prevention filter's request 
parameter name.
707e194 is described below

commit 707e1949cb4a9b7dc1430a41e28b8c72675dcced
Author: Christopher Schultz <ch...@christopherschultz.net>
AuthorDate: Tue Nov 19 12:54:45 2019 -0500

    Allow customization of the CSRF prevention filter's request parameter name.
---
 .../catalina/filters/CsrfPreventionFilter.java     | 24 +++++++++++++++++-----
 webapps/docs/changelog.xml                         |  5 +++--
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/java/org/apache/catalina/filters/CsrfPreventionFilter.java 
b/java/org/apache/catalina/filters/CsrfPreventionFilter.java
index 8aace6b..8a09cfb 100644
--- a/java/org/apache/catalina/filters/CsrfPreventionFilter.java
+++ b/java/org/apache/catalina/filters/CsrfPreventionFilter.java
@@ -53,6 +53,8 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
 
     private int nonceCacheSize = 5;
 
+    private String nonceRequestParameterName = 
Constants.CSRF_NONCE_REQUEST_PARAM;
+
     /**
      * Entry points are URLs that will not be tested for the presence of a 
valid
      * nonce. They are used to provide a way to navigate back to a protected
@@ -83,6 +85,16 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
         this.nonceCacheSize = nonceCacheSize;
     }
 
+    /**
+     * Sets the request parameter name to use for CSRF nonces.
+     *
+     * @param parameterName The request parameter name to use
+     *        for CSRF nonces.
+     */
+    public void setNonceRequestParameterName(String parameterName) {
+        this.nonceRequestParameterName = parameterName;
+    }
+
     @Override
     public void init(FilterConfig filterConfig) throws ServletException {
         // Set the parameters
@@ -91,7 +103,7 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
         // Put the expected request parameter name into the application scope
         filterConfig.getServletContext().setAttribute(
                 Constants.CSRF_NONCE_REQUEST_PARAM_NAME_KEY,
-                Constants.CSRF_NONCE_REQUEST_PARAM);
+                nonceRequestParameterName);
 
         // Put the expected request header name into the application scope
         filterConfig.getServletContext().setAttribute(
@@ -131,7 +143,7 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
 
             if (!skipNonceCheck) {
                 String previousNonce =
-                    req.getParameter(Constants.CSRF_NONCE_REQUEST_PARAM);
+                    req.getParameter(nonceRequestParameterName);
 
                 if(previousNonce == null) {
                     if(log.isDebugEnabled()) {
@@ -196,7 +208,7 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
             // requiring the use of response.encodeURL.
             request.setAttribute(Constants.CSRF_NONCE_REQUEST_ATTR_NAME, 
newNonce);
 
-            wResponse = new CsrfResponseWrapper(res, newNonce);
+            wResponse = new CsrfResponseWrapper(res, 
nonceRequestParameterName, newNonce);
         } else {
             wResponse = response;
         }
@@ -208,10 +220,12 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
     protected static class CsrfResponseWrapper
             extends HttpServletResponseWrapper {
 
+        private final String nonceRequestParameterName;
         private final String nonce;
 
-        public CsrfResponseWrapper(HttpServletResponse response, String nonce) 
{
+        public CsrfResponseWrapper(HttpServletResponse response, String 
nonceRequestParameterName, String nonce) {
             super(response);
+            this.nonceRequestParameterName = nonceRequestParameterName;
             this.nonce = nonce;
         }
 
@@ -266,7 +280,7 @@ public class CsrfPreventionFilter extends 
CsrfPreventionFilterBase {
             } else {
                 sb.append('?');
             }
-            sb.append(Constants.CSRF_NONCE_REQUEST_PARAM);
+            sb.append(nonceRequestParameterName);
             sb.append('=');
             sb.append(nonce);
             sb.append(anchor);
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 42dbde9..84377f6 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -53,8 +53,9 @@
       </fix>
       <add>
         Improvements to CsrfPreventionFilter including additional
-        logging and making the latest nonce available in the request
-        attributes. (schultz)
+        logging, making the latest nonce available in the request attributes,
+        and allowing the CSRF nonce request parameter name to be customized.
+        (schultz)
       </add>
     </changelog>
   </subsection>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Reply via email to