roda 3.76.0 → 3.77.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f4eee948a9994645560f635fd228d2f46f3f466da782a476d7046b2b0b9f026
-  data.tar.gz: 4abb6bed043b264c59e17b1120771822a26292f24037a283c08003168c72e602
+  metadata.gz: 8afa46b8055c19e63e1efeebf444b422cd810701c759936d476797515630245d
+  data.tar.gz: 4e857447435707de1d586857126795e2a1191f685ca8893e99cd1c78aeb50c02
 SHA512:
-  metadata.gz: 112d90a74ed25ae0bb608a2e89d2f6fa757912287feb3a68d312ef4b8fd317bdb8f04eb76f529090d14a92c322d869ededa831f8db5d20bce8a66cd973a71584
-  data.tar.gz: 22ddb0a055b5849c6dcd3ec93426e495198434cf1e9cf9adbae1c22ece9b788c0ea7332122b9ad525954e2b946b0eef873de3b0466fe5b844407dec6c9844c84
+  metadata.gz: 2ecfeb211d574d46bdc31995c3551afb97af50acf8567cce83b46808e87ff797a5ef7c769e42c0477ed6a6d9271040b818da72e77c91e4f91f9760201d2cd5ca
+  data.tar.gz: 45e67fbd1da64839c6dc5a8dc0975a0dca5f67a77c83ae79a62ab22e7d9cf0002cb8b8f6a22661bdaf97ad973b6bc6ff928af2e416a96c35b12150e9fe0eaf4d

data/CHANGELOG

@@ -1,3 +1,7 @@
+= 3.77.0 (2024-02-12)
+
+* Support formaction/formmethod attributes in forms in route_csrf plugin (jeremyevans)
+
 = 3.76.0 (2024-01-12)
 
 * Support :filter plugin option in error_mail and error_email for filtering parameters, environment variables, and session values (jeremyevans) (#346)

data/doc/release_notes/3.77.0.txt

@@ -0,0 +1,8 @@
+= New Features
+
+* The route_csrf plugin now supports formaction/formmethod attributes
+  in forms. A csrf_formaction_tag method has been added for creating
+  a hidden input for a particular path and method.  When a form is
+  submitted, the check_csrf! method will fix check for a path-specific
+  csrf token (set by the hidden tag added by the csrf_formaction_tag
+  method), before checking for the default csrf token.

data/lib/roda/plugins/route_csrf.rb

@@ -42,6 +42,9 @@ class Roda
     # This plugin supports the following options:
     #
     # :field :: Form input parameter name for CSRF token (default: '_csrf')
+    # :formaction_field :: Form input parameter name for path-specific CSRF tokens (used by the
+    #                      +csrf_formaction_tag+ method).  If present, this parameter should be
+    #                      submitted as a hash, keyed by path, with CSRF token values.
     # :header :: HTTP header name for CSRF token (default: 'X-CSRF-Token')
     # :key :: Session key for CSRF secret (default: '_roda_csrf_secret')
     # :require_request_specific_tokens :: Whether request-specific tokens are required (default: true).
@@ -86,6 +89,10 @@ class Roda
     #                         override any of the plugin options for this specific call.
     #                         The :token option can be used to specify the provided CSRF token
     #                         (instead of looking for the token in the submitted parameters).
+    # csrf_formaction_tag(path, method='POST') :: An HTML hidden input tag string containing the CSRF token, suitable
+    #                                             for placing in an HTML form that has inputs that use formaction
+    #                                             attributes to change the endpoint to which the form is submitted.
+    #                                             Takes the same arguments as csrf_token.
     # csrf_field :: The field name to use for the hidden tag containing the CSRF token.
     # csrf_path(action) :: This takes an argument that would be the value of the HTML form's
     #                      action attribute, and returns a path you can pass to csrf_token
@@ -152,6 +159,7 @@ class Roda
       # Default CSRF option values
       DEFAULTS = {
         :field => '_csrf'.freeze,
+        :formaction_field => '_csrfs'.freeze,
         :header => 'X-CSRF-Token'.freeze,
         :key => '_roda_csrf_secret'.freeze,
         :require_request_specific_tokens => true,
@@ -252,6 +260,14 @@ class Roda
           end
         end
 
+        # An HTML hidden input tag string containing the CSRF token, used for inputs
+        # with formaction, so the same form can be used to submit to multiple endpoints
+        # depending on which button was clicked.  See csrf_token for arguments, but the
+        # path argument is required.
+        def csrf_formaction_tag(path, *args)
+          "<input type=\"hidden\" name=\"#{csrf_options[:formaction_field]}[#{Rack::Utils.escape_html(path)}]\" value=\"#{csrf_token(path, *args)}\" \/>"
+        end
+
         # An HTML hidden input tag string containing the CSRF token.  See csrf_token for
         # arguments.
         def csrf_tag(*args)
@@ -291,6 +307,8 @@ class Roda
             return
           end
 
+          path = @_request.path
+
           unless encoded_token = opts[:token]
             encoded_token = case opts[:check_header]
             when :only
@@ -298,7 +316,8 @@ class Roda
             when true
               return (csrf_invalid_message(opts.merge(:check_header=>false)) && csrf_invalid_message(opts.merge(:check_header=>:only)))
             else
-              @_request.params[opts[:field]]
+              params = @_request.params
+              ((formactions = params[opts[:formaction_field]]).is_a?(Hash) && (formactions[path])) || params[opts[:field]]
             end
           end
 
@@ -326,7 +345,7 @@ class Roda
 
           random_data = submitted_hmac.slice!(0...31)
 
-          if csrf_compare(csrf_hmac(random_data, method, @_request.path), submitted_hmac)
+          if csrf_compare(csrf_hmac(random_data, method, path), submitted_hmac)
             return
           end
 

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 76
+  RodaMinorVersion = 77
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.76.0
+  version: 3.77.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-01-12 00:00:00.000000000 Z
+date: 2024-02-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -250,6 +250,7 @@ extra_rdoc_files:
 - doc/release_notes/3.74.0.txt
 - doc/release_notes/3.75.0.txt
 - doc/release_notes/3.76.0.txt
+- doc/release_notes/3.77.0.txt
 - doc/release_notes/3.8.0.txt
 - doc/release_notes/3.9.0.txt
 files:
@@ -333,6 +334,7 @@ files:
 - doc/release_notes/3.74.0.txt
 - doc/release_notes/3.75.0.txt
 - doc/release_notes/3.76.0.txt
+- doc/release_notes/3.77.0.txt
 - doc/release_notes/3.8.0.txt
 - doc/release_notes/3.9.0.txt
 - lib/roda.rb