SecurityCSRFSessionTest.php

<?php

declare(strict_types=1);

/**
 * This file is part of CodeIgniter 4 framework.
 *
 * (c) CodeIgniter Foundation <admin@codeigniter.com>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace CodeIgniter\Security;

use CodeIgniter\Config\Factories;
use CodeIgniter\Config\Services;
use CodeIgniter\HTTP\IncomingRequest;
use CodeIgniter\HTTP\SiteURI;
use CodeIgniter\HTTP\UserAgent;
use CodeIgniter\Security\Exceptions\SecurityException;
use CodeIgniter\Session\Handlers\ArrayHandler;
use CodeIgniter\Session\Handlers\FileHandler;
use CodeIgniter\Session\Session;
use CodeIgniter\Superglobals;
use CodeIgniter\Test\CIUnitTestCase;
use CodeIgniter\Test\Mock\MockAppConfig;
use CodeIgniter\Test\Mock\MockSession;
use CodeIgniter\Test\TestLogger;
use Config\App;
use Config\Cookie;
use Config\Logger as LoggerConfig;
use Config\Security as SecurityConfig;
use Config\Session as SessionConfig;
use PHPUnit\Framework\Attributes\Group;
use PHPUnit\Framework\Attributes\PreserveGlobalState;
use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;
use PHPUnit\Framework\Attributes\WithoutErrorHandler;

/**
 * @internal
 */
#[Group('SeparateProcess')]
#[PreserveGlobalState(false)]
#[RunTestsInSeparateProcesses]
final class SecurityCSRFSessionTest extends CIUnitTestCase
{
    /**
     * @var string CSRF protection hash
     */
    private string $hash = '8b9218a55906f9dcc1dc263dce7f005a';

    private SecurityConfig $config;

    #[WithoutErrorHandler]
    protected function setUp(): void
    {
        parent::setUp();

        $_SESSION = [];
        Factories::reset();

        Services::injectMock('superglobals', new Superglobals());

        $this->config                 = new SecurityConfig();
        $this->config->csrfProtection = Security::CSRF_PROTECTION_SESSION;
        Factories::injectMock('config', 'Security', $this->config);

        $this->injectSession($this->hash);
    }

    private function createSession($options = []): Session
    {
        $defaults = [
            'driver'            => FileHandler::class,
            'cookieName'        => 'ci_session',
            'expiration'        => 7200,
            'savePath'          => '',
            'matchIP'           => false,
            'timeToUpdate'      => 300,
            'regenerateDestroy' => false,
        ];
        $config = array_merge($defaults, $options);

        $sessionConfig = new SessionConfig();

        foreach ($config as $key => $c) {
            $sessionConfig->{$key} = $c;
        }

        $cookie = new Cookie();

        foreach ([
            'prefix'   => '',
            'domain'   => '',
            'path'     => '/',
            'secure'   => false,
            'samesite' => 'Lax',
        ] as $key => $value) {
            $cookie->{$key} = $value;
        }
        Factories::injectMock('config', 'Cookie', $cookie);

        $session = new MockSession(new ArrayHandler($sessionConfig, '127.0.0.1'), $sessionConfig);
        $session->setLogger(new TestLogger(new LoggerConfig()));

        return $session;
    }

    private function injectSession(string $hash): void
    {
        $session = $this->createSession();
        $session->set('csrf_test_name', $hash);
        Services::injectMock('session', $session);
    }

    private function createSecurity(): Security
    {
        return new Security($this->config);
    }

    public function testHashIsReadFromSession(): void
    {
        $security = $this->createSecurity();

        $this->assertSame($this->hash, $security->getHash());
    }

    public function testCSRFVerifyPostThrowsExceptionOnNoMatch(): void
    {
        $this->expectException(SecurityException::class);

        service('superglobals')
            ->setServer('REQUEST_METHOD', 'POST')
            ->setPost('csrf_test_name', '8b9218a55906f9dcc1dc263dce7f005b');

        $request  = $this->createIncomingRequest();
        $security = $this->createSecurity();

        $security->verify($request);
    }

    private function createIncomingRequest(?App $config = null): IncomingRequest
    {
        $config ??= new MockAppConfig();

        return new IncomingRequest($config, new SiteURI($config), null, new UserAgent());
    }

    public function testCSRFVerifyPostReturnsSelfOnMatch(): void
    {
        service('superglobals')
            ->setServer('REQUEST_METHOD', 'POST')
            ->setPost('foo', 'bar')
            ->setPost('csrf_test_name', '8b9218a55906f9dcc1dc263dce7f005a');

        $request  = $this->createIncomingRequest();
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
        $this->assertCount(1, service('superglobals')->getPostArray());
    }

    public function testCSRFVerifyPOSTHeaderThrowsExceptionOnNoMatch(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'POST');

        $request = $this->createIncomingRequest();
        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005b');
        $security = $this->createSecurity();

        $this->expectException(SecurityException::class);
        $security->verify($request);
    }

    public function testCSRFVerifyPOSTHeaderReturnsSelfOnMatch(): void
    {
        service('superglobals')
            ->setServer('REQUEST_METHOD', 'POST')
            ->setPost('foo', 'bar');

        $request = $this->createIncomingRequest();
        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005a');
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
        $this->assertCount(1, service('superglobals')->getPostArray());
    }

    public function testCSRFVerifyPUTHeaderThrowsExceptionOnNoMatch(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'PUT');

        $request = $this->createIncomingRequest();
        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005b');
        $security = $this->createSecurity();

        $this->expectException(SecurityException::class);
        $security->verify($request);
    }

    public function testCSRFVerifyPUTHeaderReturnsSelfOnMatch(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'PUT');

        $request = $this->createIncomingRequest();
        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005a');
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
    }

    public function testCSRFVerifyPUTBodyReturnsSelfOnMatch(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'PUT');

        $request = $this->createIncomingRequest();
        $request->setBody('csrf_test_name=8b9218a55906f9dcc1dc263dce7f005a&foo=bar');
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
    }

    public function testCSRFVerifyJsonThrowsExceptionOnNoMatch(): void
    {
        $this->expectException(SecurityException::class);

        service('superglobals')->setServer('REQUEST_METHOD', 'POST');

        $request = $this->createIncomingRequest();
        $request->setBody('{"csrf_test_name":"8b9218a55906f9dcc1dc263dce7f005b"}');
        $security = $this->createSecurity();

        $security->verify($request);
    }

    public function testCSRFVerifyJsonReturnsSelfOnMatch(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'POST');

        $request = $this->createIncomingRequest();
        $request->setBody('{"csrf_test_name":"8b9218a55906f9dcc1dc263dce7f005a","foo":"bar"}');
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
        $this->assertSame('{"foo":"bar"}', $request->getBody());
    }

    public function testCSRFVerifyHeaderWithJsonBodyPreservesBody(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'POST');

        $request = $this->createIncomingRequest();
        $body    = '{"foo":"bar"}';

        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005a');
        $request->setBody($body);
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
        $this->assertSame($body, $request->getBody());
    }

    public function testCSRFVerifyHeaderWithJsonBodyStripsTokenFromBody(): void
    {
        service('superglobals')->setServer('REQUEST_METHOD', 'POST');

        $request = $this->createIncomingRequest();

        $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005a');
        $request->setBody('{"csrf_test_name":"8b9218a55906f9dcc1dc263dce7f005a","foo":"bar"}');
        $security = $this->createSecurity();

        $this->assertInstanceOf(Security::class, $security->verify($request));
        $this->assertLogged('info', 'CSRF token verified.');
        $this->assertSame('{"foo":"bar"}', $request->getBody());
    }

    public function testRegenerateWithFalseSecurityRegenerateProperty(): void
    {
        service('superglobals')
            ->setServer('REQUEST_METHOD', 'POST')
            ->setPost('csrf_test_name', '8b9218a55906f9dcc1dc263dce7f005a');

        /**
         * @var SecurityConfig
         */
        $config             = Factories::config('Security');
        $config->regenerate = false;
        Factories::injectMock('config', 'Security', $config);

        $request  = $this->createIncomingRequest();
        $security = $this->createSecurity();

        $oldHash = $security->getHash();
        $security->verify($request);
        $newHash = $security->getHash();

        $this->assertSame($oldHash, $newHash);
    }

    public function testRegenerateWithTrueSecurityRegenerateProperty(): void
    {
        service('superglobals')
            ->setServer('REQUEST_METHOD', 'POST')
            ->setPost('csrf_test_name', '8b9218a55906f9dcc1dc263dce7f005a');

        /**
         * @var SecurityConfig
         */
        $config             = Factories::config('Security');
        $config->regenerate = true;
        Factories::injectMock('config', 'Security', $config);

        $request  = $this->createIncomingRequest();
        $security = $this->createSecurity();

        $oldHash = $security->getHash();
        $security->verify($request);
        $newHash = $security->getHash();

        $this->assertNotSame($oldHash, $newHash);
    }
}