platformos-check 0.4.5 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e25de2efbace27cbcb87f0166520a416c0a275dccd641524a3f3ea1b95190779
-  data.tar.gz: d4bc78729da09cb589caa3472e01c4735161d454b697560a894877073d21398e
+  metadata.gz: 737ae774f598b10b46e556298d68e7eafe711c00ef6463c30ba8f8736c6cf42a
+  data.tar.gz: 443998e3955d4032ab41b2d5189ff42f5a736781b05cf0bdfa2a8dfe1b4fe629
 SHA512:
-  metadata.gz: 5dd2688e9b917dc3af698bcbf135bafc016bbfba8d24c46bd62528315d594322cf186913cbd6319a8d9275f8357a5d2d8067b542bd5fb90828532556464e4237
-  data.tar.gz: b1308c97e7721df699c423e9c1e111fee82e0bd31e79c8b55a1300baf5547fe115c35a9435ed16e5e2c68c825b230a6b710aba225d32f62a1ea3bee47a2204bd
+  metadata.gz: 5049fd3616a7721b1d23920c87436ed19a525d96454ef18a93cb22ba210e733a5984c154f3a79778f047769fa059052fc65b3ca56cc02d70e4ee5e108c568b29
+  data.tar.gz: c7dcafbce9b30fc5fd2b954a080e4f167f24c7fcfbc8ea48b6131b54eb33eb71657f45068075c1ea2f9f6520682a33f94eb207e0a68341e10f9abcda4939b8db

data/CHANGELOG.md

@@ -1,4 +1,9 @@
-v0.4.5 / 2023-12-04
+v0.4.6 / 2023-12-19
+==================
+
+  * Add FormAuthenticityToken check
+
+v0.4.5 / 2023-12-19
 ==================
 
   * Add FormAction check

data/config/default.yml

@@ -91,6 +91,10 @@ FormAction:
   enabled: true
   ignore: []
 
+FormAuthenticityToken:
+  enabled: true
+  ignore: []
+
 HtmlParsingError:
   enabled: true
   ignore: []

data/docs/checks/form_authenticity_token.md

@@ -0,0 +1,55 @@
+# Form authenticity token (`FormAuthenticityToken`)
+
+In platformOS all POST/PATCH/PUT/DELETE requests are protected from [CSRF Attacks][csrf-attack] through [authenticity_token][page-csrf]
+Form action defines the endpoint to which browser will make a request after submitting it.
+
+As a general rule you should include hidden input `<input type="hidden" name="authenticity_token" value="{{ context.authenticity_token }}">` in every form. Missing it will result in session invalidation and any logged in user will be automatically logged out.
+
+## Check Details
+
+This check is aimed at ensuring you have not forgotten to include authenticity_token in a form.
+
+:-1: Examples of **incorrect** code for this check:
+
+```liquid
+<form action="dummy/create">
+</form>
+```
+
+:+1: Examples of **correct** code for this check:
+
+```liquid
+<form action="/dummy/create">
+  <input type="hidden" name="authenticity_token" value="{{ context.authenticity_token }}">
+</form>
+```
+
+## Check Options
+
+The default configuration for this check is the following:
+
+```yaml
+FormAuthenticityToken:
+  enabled: true
+```
+
+## When Not To Use It
+
+There should be no cases where disabling this rule is needed.
+
+## Version
+
+This check has been introduced in PlatformOS Check 0.46.0.
+
+## Resources
+
+- [Rule Source][codesource]
+- [Documentation Source][docsource]
+- [platformOS Page documentation][page-csrf]
+- [OWASP Cross Site Request Forgery][csrf-attack]
+
+[codesource]: /lib/platformos_check/checks/form_authenticity_token.rb
+[docsource]: /docs/checks/form_authenticity_token.md
+[page-csrf]: https://documentation.platformos.com/developer-guide/pages/pages#post-put-patch-delete-methods-and-cross-site-request-forgery-attacks
+[csrf-attack]: https://owasp.org/www-community/attacks/csrf
+

data/lib/platformos_check/checks/form_authenticity_token.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module PlatformosCheck
+  class FormAuthenticityToken < HtmlCheck
+    severity :error
+    categories :html
+    doc docs_url(__FILE__)
+
+    AUTHENTICITY_TOKEN_VALUE = /\A\s*{{\s*context\.authenticity_token\s*}}\s*\z/
+
+    def on_form(node)
+      authenticity_toke_inputs = node.children.select { |c| c.name == 'input' && c.attributes['name'] == 'authenticity_token' && c.attributes['value']&.match?(AUTHENTICITY_TOKEN_VALUE) }
+      return if authenticity_toke_inputs.size == 1
+      return add_offense('Duplicated authenticity_token inputs', node:) if authenticity_toke_inputs.size > 1
+
+      add_offense('Missing authenticity_token input <input type="hidden" name="authenticity_token" value="{{ context.authenticity_token }}">', node:) do |corrector|
+        corrector.insert_after(node, "\n<input type=\"hidden\" name=\"authenticity_token\" value=\"{{ context.authenticity_token }}\">")
+      end
+    end
+  end
+end

data/lib/platformos_check/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PlatformosCheck
-  VERSION = "0.4.5"
+  VERSION = "0.4.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: platformos-check
 version: !ruby/object:Gem::Version
-  version: 0.4.5
+  version: 0.4.6
 platform: ruby
 authors:
 - Piotr Bliszczyk
@@ -118,6 +118,7 @@ files:
 - docs/checks/convert_include_to_render.md
 - docs/checks/deprecated_filter.md
 - docs/checks/form_action.md
+- docs/checks/form_authenticity_token.md
 - docs/checks/html_parsing_error.md
 - docs/checks/img_lazy_loading.md
 - docs/checks/img_width_and_height.md
@@ -161,6 +162,7 @@ files:
 - lib/platformos_check/checks/convert_include_to_render.rb
 - lib/platformos_check/checks/deprecated_filter.rb
 - lib/platformos_check/checks/form_action.rb
+- lib/platformos_check/checks/form_authenticity_token.rb
 - lib/platformos_check/checks/html_parsing_error.rb
 - lib/platformos_check/checks/img_lazy_loading.rb
 - lib/platformos_check/checks/img_width_and_height.rb