Merge pull request #55 from naucon/csrf_token

extend security extension by csrf token manager and csrf token modifier

Author: vitorbrandao

Extension/SecurityExtension.php

@@ -28,8 +28,11 @@
 namespace NoiseLabs\Bundle\SmartyBundle\Extension;
 
 use NoiseLabs\Bundle\SmartyBundle\Extension\Plugin\ModifierPlugin;
+use NoiseLabs\Bundle\SmartyBundle\Exception\RuntimeException;
 use Symfony\Component\Security\Acl\Voter\FieldVote;
 use Symfony\Component\Security\Core\SecurityContextInterface;
+use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
+use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
 
 /**
  * SecurityExtension exposes security context features.
@@ -39,15 +42,18 @@
 class SecurityExtension extends AbstractExtension
 {
     protected $context;
+    protected $csrfTokenManager;
 
     /**
      * Constructor.
      *
      * @param SecurityContextInterface $context A SecurityContext instance
+     * @param CsrfTokenManagerInterface
      */
-    public function __construct(SecurityContextInterface $context = null)
+    public function __construct(SecurityContextInterface $context = null, $csrfTokenManager = null)
     {
         $this->context = $context;
+        $this->csrfTokenManager = $csrfTokenManager;
     }
 
     /**
@@ -57,6 +63,7 @@ public function getPlugins()
     {
         return array(
             new ModifierPlugin('is_granted', $this, 'isGranted'),
+            new ModifierPlugin('csrf_token', $this, 'getCsrfToken'),
         );
     }
 
@@ -73,6 +80,24 @@ public function isGranted($role, $object = null, $field = null)
         return $this->context->isGranted($role, $object);
     }
 
+    public function getCsrfToken($tokenId)
+    {
+        if ($this->csrfTokenManager instanceof CsrfProviderInterface) {
+            $tokenValue = $this->csrfTokenManager->generateCsrfToken($tokenId);
+        }
+        elseif ($this->csrfTokenManager instanceof CsrfTokenManagerInterface) {
+            $tokenValue = $this->csrfTokenManager->getToken($tokenId)->getValue();
+        } else {
+            $this->csrfTokenManager = null;
+        }
+
+        if (null === $this->csrfTokenManager) {
+            throw new RuntimeException('CSRF tokens can only be generated if a CsrfProviderInterface or CsrfTokenManagerInterface is injected in SecurityExtension::__construct().');
+        }
+
+        return $tokenValue;
+    }
+
     /**
      * Returns the name of the extension.
      *

Resources/config/smarty.xml

@@ -61,6 +61,8 @@
         <service id="smarty.extension.security" class="%smarty.extension.security.class%" public="false">
             <tag name="smarty.extension" />
             <argument type="service" id="security.context" on-invalid="ignore" />
+            <argument type="service" id="form.csrf_provider" on-invalid="null" />
+            <!--<argument type="service" id="security.csrf.token_manager" on-invalid="ignore" />-->
         </service>
 
         <service id="smarty.extension.expression" class="%smarty.extension.expression.class%" public="false">

Tests/Extension/SecurityExtensionTest.php

@@ -83,6 +83,38 @@ public function getIsGrantedTests()
         );
     }
 
+    public function testCsrfTokenWithCsrfTokenManager()
+    {
+        $tokenId = 'foo';
+        $tokenValue = 'xsrf';
+        $content = "{'$tokenId'|csrf_token}";
+        $template = 'csrf_token_manager_test.html.tpl';
+
+        // symfony 2.3+
+        $this->engine->setTemplate($template, $content);
+        $context = $this->createSecurityContext();
+        $csrfTokenManager = $this->createCsrfTokenManager($tokenId, $tokenValue);
+        $this->engine->addExtension(new SecurityExtension($context, $csrfTokenManager));
+
+        $this->assertEquals($tokenValue, $this->engine->render($template));
+    }
+
+    public function testCsrfTokenWithCsrfProvider()
+    {
+        $tokenId = 'bar';
+        $tokenValue = 'xsrf';
+        $content = "{'$tokenId'|csrf_token}";
+        $template = 'csrf_provider_test.html.tpl';
+
+        // symfony 2.1
+        $this->engine->setTemplate($template, $content);
+        $context = $this->createSecurityContext();
+        $csrfProvider = $this->createCsrfProvider($tokenId, $tokenValue);
+        $this->engine->addExtension(new SecurityExtension($context, $csrfProvider));
+
+        $this->assertEquals($tokenValue, $this->engine->render($template));
+    }
+
     protected function createSecurityContext($granted = false)
     {
         $authManager = $this->getMock('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface');
@@ -99,4 +131,22 @@ protected function createSecurityContext($granted = false)
 
         return $context;
     }
+
+    protected function createCsrfTokenManager($tokenId, $value)
+    {
+        $csrfToken = $this->getMock('stdClass', array('getValue'));
+        $csrfToken->expects($this->any())->method('getValue')->will($this->returnValue($value));
+        $csrfTokenManager = $this->getMock('Symfony\Component\Security\Csrf\CsrfTokenManagerInterface', array('getToken', 'refreshToken', 'removeToken', 'isTokenValid'));
+        $csrfTokenManager->expects($this->any())->method('getToken')->will($this->returnValue($csrfToken));
+
+        return $csrfTokenManager;
+    }
+
+    protected function createCsrfProvider($tokenId, $value)
+    {
+        $csrfProvider = $this->getMock('Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface', array('generateCsrfToken'));
+        $csrfProvider->expects($this->any())->method('generateCsrfToken')->will($this->returnValue($value));
+
+        return $csrfProvider;
+    }
 }