Register root form types as services to support stateless CSRF protection

Author: hlecorche

config/crud.php

@@ -17,7 +17,9 @@
 use Ecommit\CrudBundle\Crud\CrudFactory;
 use Ecommit\CrudBundle\Crud\CrudResponseGenerator;
 use Ecommit\CrudBundle\EventListener\MappingEntities;
+use Ecommit\CrudBundle\Form\Type\DisplaySettingsType;
 use Ecommit\CrudBundle\Form\Type\EntityAjaxType;
+use Ecommit\CrudBundle\Form\Type\FormSearchType;
 use Ecommit\CrudBundle\Twig\CrudExtension;
 use Symfony\Component\DependencyInjection\ServiceLocator;
 use Symfony\Component\Form\FormFactoryInterface;
@@ -65,5 +67,11 @@
             service(RouterInterface::class),
         ])
         ->tag('form.type')
+
+        ->set(FormSearchType::class)
+        ->autoconfigure()
+
+        ->set(DisplaySettingsType::class)
+        ->autoconfigure()
     ;
 };

tests/Functional/App/StatelessCsrfKernel.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the EcommitCrudBundle package.
+ *
+ * (c) E-commit <contact@e-commit.fr>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Ecommit\CrudBundle\Tests\Functional\App;
+
+use Symfony\Component\Config\Loader\LoaderInterface;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+
+class StatelessCsrfKernel extends Kernel
+{
+    public const COOKIE_NAME = 'stateless-csrf-token';
+
+    protected function configureContainer(ContainerBuilder $container, LoaderInterface $loader): void
+    {
+        parent::configureContainer($container, $loader);
+
+        $container->loadFromExtension('framework', [
+            'csrf_protection' => [
+                'stateless_token_ids' => ['submit'],
+                'cookie_name' => self::COOKIE_NAME,
+            ],
+            'form' => [
+                'csrf_protection' => [
+                    'token_id' => 'submit',
+                ],
+            ],
+        ]);
+    }
+
+    public function getCacheDir(): string
+    {
+        return parent::getCacheDir().'/stateless_csrf';
+    }
+}

tests/Functional/Controller/StatelessCsrfTest.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the EcommitCrudBundle package.
+ *
+ * (c) E-commit <contact@e-commit.fr>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Ecommit\CrudBundle\Tests\Functional\Controller;
+
+use Ecommit\CrudBundle\Tests\Functional\App\StatelessCsrfKernel;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpKernel\Kernel;
+
+class StatelessCsrfTest extends WebTestCase
+{
+    protected function setUp(): void
+    {
+        if (Kernel::VERSION_ID < 70200) { // @legacy
+            $this->markTestSkipped('The stateless CSRF protection requires Symfony 7.2 or later.');
+        }
+    }
+
+    protected static function getKernelClass(): string
+    {
+        return StatelessCsrfKernel::class;
+    }
+
+    /**
+     * @dataProvider getTestFormsUseStatelessCsrfTokenProvider
+     */
+    public function testFormsUseStatelessCsrfToken(string $tokenId): void
+    {
+        $client = static::createClient();
+        $crawler = $client->request('GET', '/user');
+
+        $this->assertResponseIsSuccessful();
+        // When the token is not stateless, the value is a token stored in the session
+        $this->assertSame(StatelessCsrfKernel::COOKIE_NAME, $crawler->filterXPath(\sprintf('//input[@id="%s"]', $tokenId))->attr('value'));
+    }
+
+    public static function getTestFormsUseStatelessCsrfTokenProvider(): array
+    {
+        return [
+            ['crud_search_user__token'],
+            ['crud_display_settings_user__token'],
+        ];
+    }
+}