1 files changed, 293 insertions, 49 deletions

diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index f8cf79a257..1984ad8825 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -1,5 +1,4 @@
 require 'abstract_unit'
-require 'digest/sha1'
 require "active_support/log_subscriber/test_helper"
 
 # common controller actions
@@ -13,7 +12,7 @@ module RequestForgeryProtectionActions
   end
 
   def unsafe
-    render :text => 'pwn'
+    render plain: 'pwn'
   end
 
   def meta
@@ -72,17 +71,17 @@ class RequestForgeryProtectionControllerUsingNullSession < ActionController::Bas
 
   def signed
     cookies.signed[:foo] = 'bar'
-    render :nothing => true
+    head :ok
   end
 
   def encrypted
     cookies.encrypted[:foo] = 'bar'
-    render :nothing => true
+    head :ok
   end
 
   def try_to_reset_session
     reset_session
-    render :nothing => true
+    head :ok
   end
 end
 
@@ -129,13 +128,27 @@ class CustomAuthenticityParamController < RequestForgeryProtectionControllerUsin
   end
 end
 
+class PerFormTokensController < ActionController::Base
+  protect_from_forgery :with => :exception
+  self.per_form_csrf_tokens = true
+
+  def index
+    render inline: "<%= form_tag (params[:form_path] || '/per_form_tokens/post_one'), method: (params[:form_method] || :post) %>"
+  end
+
+  def post_one
+    render plain: ''
+  end
+
+  def post_two
+    render plain: ''
+  end
+end
+
 # common test methods
 module RequestForgeryProtectionTests
   def setup
-    @token      = "cf50faa3fe97702ca1ae"
-    @controller.stubs(:form_authenticity_token).returns(@token)
-    @controller.stubs(:valid_authenticity_token?).with{ |_, t| t == @token }.returns(true)
-    @controller.stubs(:valid_authenticity_token?).with{ |_, t| t != @token }.returns(false)
+    @token = Base64.strict_encode64('railstestrailstestrailstestrails')
     @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
     ActionController::Base.request_forgery_protection_token = :custom_authenticity_token
   end
@@ -145,17 +158,21 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_render_form_with_token_tag
-    assert_not_blocked do
-      get :index
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :index
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_button_to_with_token_tag
-    assert_not_blocked do
-      get :show_button
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :show_button
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_form_without_token_tag_if_remote
@@ -199,17 +216,21 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_remote_with_token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :form_for_remote_with_token
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_form_with_token_tag_with_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_with_token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :form_for_with_token
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_allow_get
@@ -249,41 +270,92 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_allow_post_with_token
-    assert_not_blocked { post :index, params: { custom_authenticity_token: @token } }
+    session[:_csrf_token] = @token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked { post :index, params: { custom_authenticity_token: @token } }
+    end
   end
 
   def test_should_allow_patch_with_token
-    assert_not_blocked { patch :index, params: { custom_authenticity_token: @token } }
+    session[:_csrf_token] = @token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked { patch :index, params: { custom_authenticity_token: @token } }
+    end
   end
 
   def test_should_allow_put_with_token
-    assert_not_blocked { put :index, params: { custom_authenticity_token: @token } }
+    session[:_csrf_token] = @token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked { put :index, params: { custom_authenticity_token: @token } }
+    end
   end
 
   def test_should_allow_delete_with_token
-    assert_not_blocked { delete :index, params: { custom_authenticity_token: @token } }
+    session[:_csrf_token] = @token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked { delete :index, params: { custom_authenticity_token: @token } }
+    end
   end
 
   def test_should_allow_post_with_token_in_header
+    session[:_csrf_token] = @token
     @request.env['HTTP_X_CSRF_TOKEN'] = @token
     assert_not_blocked { post :index }
   end
 
   def test_should_allow_delete_with_token_in_header
+    session[:_csrf_token] = @token
     @request.env['HTTP_X_CSRF_TOKEN'] = @token
     assert_not_blocked { delete :index }
   end
 
   def test_should_allow_patch_with_token_in_header
+    session[:_csrf_token] = @token
     @request.env['HTTP_X_CSRF_TOKEN'] = @token
     assert_not_blocked { patch :index }
   end
 
   def test_should_allow_put_with_token_in_header
+    session[:_csrf_token] = @token
     @request.env['HTTP_X_CSRF_TOKEN'] = @token
     assert_not_blocked { put :index }
   end
 
+  def test_should_allow_post_with_origin_checking_and_correct_origin
+    forgery_protection_origin_check do
+      session[:_csrf_token] = @token
+      @controller.stub :form_authenticity_token, @token do
+        assert_not_blocked do
+          @request.set_header 'HTTP_ORIGIN', 'http://test.host'
+          post :index, params: { custom_authenticity_token: @token }
+        end
+      end
+    end
+  end
+
+  def test_should_allow_post_with_origin_checking_and_no_origin
+    forgery_protection_origin_check do
+      session[:_csrf_token] = @token
+      @controller.stub :form_authenticity_token, @token do
+        assert_not_blocked do
+          post :index, params: { custom_authenticity_token: @token }
+        end
+      end
+    end
+  end
+
+  def test_should_block_post_with_origin_checking_and_wrong_origin
+    forgery_protection_origin_check do
+      session[:_csrf_token] = @token
+      @controller.stub :form_authenticity_token, @token do
+        assert_blocked do
+          @request.set_header 'HTTP_ORIGIN', 'http://bad.host'
+          post :index, params: { custom_authenticity_token: @token }
+        end
+      end
+    end
+  end
+
   def test_should_warn_on_missing_csrf_token
     old_logger = ActionController::Base.logger
     logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
@@ -333,6 +405,7 @@ module RequestForgeryProtectionTests
 
   # Allow non-GET requests since GET is all a remote <script> tag can muster.
   def test_should_allow_non_get_js_without_xhr_header
+    session[:_csrf_token] = @token
     assert_cross_origin_not_blocked { post :same_origin_js, params: { custom_authenticity_token: @token } }
     assert_cross_origin_not_blocked { post :same_origin_js, params: { format: 'js', custom_authenticity_token: @token } }
     assert_cross_origin_not_blocked do
@@ -358,7 +431,6 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_not_raise_error_if_token_is_not_a_string
-    @controller.unstub(:valid_authenticity_token?)
     assert_blocked do
       patch :index, params: { custom_authenticity_token: { foo: 'bar' } }
     end
@@ -385,6 +457,16 @@ module RequestForgeryProtectionTests
   def assert_cross_origin_not_blocked
     assert_not_blocked { yield }
   end
+
+  def forgery_protection_origin_check
+    old_setting = ActionController::Base.forgery_protection_origin_check
+    ActionController::Base.forgery_protection_origin_check = true
+    begin
+      yield
+    ensure
+      ActionController::Base.forgery_protection_origin_check = old_setting
+    end
+  end
 end
 
 # OK let's get our test on
@@ -402,11 +484,13 @@ class RequestForgeryProtectionControllerUsingResetSessionTest < ActionController
   end
 
   test 'should emit a csrf-param meta tag and a csrf-token meta tag' do
-    @controller.stubs(:form_authenticity_token).returns(@token + '<=?')
-    get :meta
-    assert_select 'meta[name=?][content=?]', 'csrf-param', 'custom_authenticity_token'
-    assert_select 'meta[name=?]', 'csrf-token'
-    assert_match(/cf50faa3fe97702ca1ae&lt;=\?/, @response.body)
+    @controller.stub :form_authenticity_token, @token + '<=?' do
+      get :meta
+      assert_select 'meta[name=?][content=?]', 'csrf-param', 'custom_authenticity_token'
+      assert_select 'meta[name=?]', 'csrf-token'
+      regexp = "#{@token}&lt;=\?"
+      assert_match(/#{regexp}/, @response.body)
+    end
   end
 end
 
@@ -473,10 +557,10 @@ class PrependProtectForgeryBaseControllerTest < ActionController::TestCase
     assert_equal(expected_callback_order, @controller.called_callbacks)
   end
 
-  def test_verify_authenticity_token_is_prepended_by_default
+  def test_verify_authenticity_token_is_not_prepended_by_default
     @controller = PrependDefaultController.new
     get :index
-    expected_callback_order = ["verify_authenticity_token", "custom_action"]
+    expected_callback_order = ["custom_action", "verify_authenticity_token"]
     assert_equal(expected_callback_order, @controller.called_callbacks)
   end
 end
@@ -484,32 +568,37 @@ end
 class FreeCookieControllerTest < ActionController::TestCase
   def setup
     @controller = FreeCookieController.new
-    @request    = ActionController::TestRequest.new
-    @response   = ActionController::TestResponse.new
     @token      = "cf50faa3fe97702ca1ae"
-
-    SecureRandom.stubs(:base64).returns(@token)
+    super
   end
 
   def test_should_not_render_form_with_token_tag
-    get :index
-    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    SecureRandom.stub :base64, @token do
+      get :index
+      assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    end
   end
 
   def test_should_not_render_button_to_with_token_tag
-    get :show_button
-    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    SecureRandom.stub :base64, @token do
+      get :show_button
+      assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    end
   end
 
   def test_should_allow_all_methods_without_token
-    [:post, :patch, :put, :delete].each do |method|
-      assert_nothing_raised { send(method, :index)}
+    SecureRandom.stub :base64, @token do
+      [:post, :patch, :put, :delete].each do |method|
+        assert_nothing_raised { send(method, :index)}
+      end
     end
   end
 
   test 'should not emit a csrf-token meta tag' do
-    get :meta
-    assert @response.body.blank?
+    SecureRandom.stub :base64, @token do
+      get :meta
+      assert @response.body.blank?
+    end
   end
 end
 
@@ -530,11 +619,11 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
 
   def test_should_not_warn_if_form_authenticity_param_matches_form_authenticity_token
     ActionController::Base.logger = @logger
-    @controller.stubs(:valid_authenticity_token?).returns(:true)
-
     begin
-      post :index, params: { custom_token_name: 'foobar' }
-      assert_equal 0, @logger.logged(:warn).size
+      @controller.stub :valid_authenticity_token?, :true do
+        post :index, params: { custom_token_name: 'foobar' }
+        assert_equal 0, @logger.logged(:warn).size
+      end
     ensure
       ActionController::Base.logger = @old_logger
     end
@@ -551,3 +640,158 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
     end
   end
 end
+
+class PerFormTokensControllerTest < ActionController::TestCase
+  def test_per_form_token_is_same_size_as_global_token
+    get :index
+    expected = ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH
+    actual = @controller.send(:per_form_csrf_token, session, '/path', 'post').size
+    assert_equal expected, actual
+  end
+
+  def test_accepts_token_for_correct_path_and_method
+    get :index
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    actual = @controller.send(:unmask_token, Base64.strict_decode64(form_token))
+    expected = @controller.send(:per_form_csrf_token, session, '/per_form_tokens/post_one', 'post')
+    assert_equal expected, actual
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token}
+    end
+    assert_response :success
+  end
+
+  def test_rejects_token_for_incorrect_path
+    get :index
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    actual = @controller.send(:unmask_token, Base64.strict_decode64(form_token))
+    expected = @controller.send(:per_form_csrf_token, session, '/per_form_tokens/post_one', 'post')
+    assert_equal expected, actual
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_two'
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      post :post_two, params: {custom_authenticity_token: form_token}
+    end
+  end
+
+  def test_rejects_token_for_incorrect_method
+    get :index
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    actual = @controller.send(:unmask_token, Base64.strict_decode64(form_token))
+    expected = @controller.send(:per_form_csrf_token, session, '/per_form_tokens/post_one', 'post')
+    assert_equal expected, actual
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one'
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      patch :post_one, params: {custom_authenticity_token: form_token}
+    end
+  end
+
+  def test_accepts_global_csrf_token
+    get :index
+
+    token = @controller.send(:form_authenticity_token)
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: token}
+    end
+    assert_response :success
+  end
+
+  def test_ignores_params
+    get :index, params: {form_path: '/per_form_tokens/post_one?foo=bar'}
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    actual = @controller.send(:unmask_token, Base64.strict_decode64(form_token))
+    expected = @controller.send(:per_form_csrf_token, session, '/per_form_tokens/post_one', 'post')
+    assert_equal expected, actual
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one?foo=baz'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token, baz: 'foo'}
+    end
+    assert_response :success
+  end
+
+  def test_ignores_trailing_slash_during_generation
+    get :index, params: {form_path: '/per_form_tokens/post_one/'}
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token}
+    end
+    assert_response :success
+  end
+
+  def test_ignores_trailing_slash_during_validation
+    get :index
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one/'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token}
+    end
+    assert_response :success
+  end
+
+  def test_method_is_case_insensitive
+    get :index, params: {form_method: "POST"}
+
+    form_token = nil
+    assert_select 'input[name=custom_authenticity_token]' do |elts|
+      form_token = elts.first['value']
+      assert_not_nil form_token
+    end
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one/'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token}
+    end
+    assert_response :success
+  end
+end