Skip to content

Commit fee4da0

Browse files
WendellAdrielWendellAdriel
authored
feat(router): add method spoofing support for HTML forms (#1536)
1 parent 07d81d1 commit fee4da0

File tree

4 files changed

+186
-2
lines changed

4 files changed

+186
-2
lines changed

‎packages/http/src/Mappers/PsrRequestToGenericRequestMapper.php‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function map(mixed $from, mixed $to): GenericRequest
5555
);
5656

5757
return map([
58-
'method' => Method::from($from->getMethod()),
58+
'method' => $this->requestMethod($from, $data),
5959
'uri' => (string) $from->getUri(),
6060
'raw' => $raw,
6161
'body' => $data,
@@ -81,4 +81,18 @@ public function map(mixed $from, mixed $to): GenericRequest
8181
])
8282
->to(GenericRequest::class);
8383
}
84+
85+
private function requestMethod(PsrRequest $request, array $data): Method
86+
{
87+
$originalMethod = Method::from($request->getMethod());
88+
if ($originalMethod !== Method::POST) {
89+
return $originalMethod;
90+
}
91+
92+
if (! isset($data['_method'])) {
93+
return $originalMethod;
94+
}
95+
96+
return Method::trySpoofingFrom($data['_method']) ?? $originalMethod;
97+
}
8498
}

‎packages/http/src/Method.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,14 @@ enum Method: string
1515
case OPTIONS = 'OPTIONS';
1616
case TRACE = 'TRACE';
1717
case PATCH = 'PATCH';
18+
19+
public static function trySpoofingFrom(string $method): ?Method
20+
{
21+
$method = Method::tryFrom(strtoupper($method));
22+
23+
return match ($method) {
24+
self::DELETE, self::PATCH, self::PUT => $method,
25+
default => null,
26+
};
27+
}
1828
}

‎packages/http/tests/Mappers/PsrRequestToGenericRequestMapperTest.php‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Tempest\Http\Tests\Mappers;
6+
7+
use Laminas\Diactoros\ServerRequest;
8+
use Laminas\Diactoros\Stream;
9+
use PHPUnit\Framework\Attributes\DataProvider;
10+
use PHPUnit\Framework\TestCase;
11+
use Psr\Http\Message\ServerRequestInterface;
12+
use ReflectionClass;
13+
use ReflectionMethod;
14+
use Tempest\Clock\GenericClock;
15+
use Tempest\Core\AppConfig;
16+
use Tempest\Cryptography\Encryption\EncryptionAlgorithm;
17+
use Tempest\Cryptography\Encryption\EncryptionConfig;
18+
use Tempest\Cryptography\Encryption\GenericEncrypter;
19+
use Tempest\Cryptography\Signing\GenericSigner;
20+
use Tempest\Cryptography\Signing\SigningAlgorithm;
21+
use Tempest\Cryptography\Signing\SigningConfig;
22+
use Tempest\Cryptography\Timelock;
23+
use Tempest\Http\Cookie\CookieManager;
24+
use Tempest\Http\Mappers\PsrRequestToGenericRequestMapper;
25+
use Tempest\Http\Method;
26+
27+
final class PsrRequestToGenericRequestMapperTest extends TestCase
28+
{
29+
private PsrRequestToGenericRequestMapper $mapper;
30+
private ReflectionMethod $requestMethod;
31+
32+
protected function setUp(): void
33+
{
34+
parent::setUp();
35+
36+
$this->mapper = new PsrRequestToGenericRequestMapper(
37+
$this->createEncrypter(),
38+
new CookieManager(
39+
new AppConfig(baseUri: 'https://test.com'),
40+
new GenericClock(),
41+
),
42+
);
43+
44+
$reflection = new ReflectionClass($this->mapper);
45+
$this->requestMethod = $reflection->getMethod('requestMethod');
46+
$this->requestMethod->setAccessible(true);
47+
}
48+
49+
#[DataProvider('nonPostMethodsProvider')]
50+
public function test_non_post_requests_are_not_affected_by_method_param(string $originalMethod): void
51+
{
52+
$request = $this->createServerRequest(
53+
$originalMethod,
54+
['_method' => 'DELETE'],
55+
);
56+
57+
$method = $this->requestMethod->invoke($this->mapper, $request, ['_method' => 'DELETE']);
58+
59+
$this->assertSame(Method::from($originalMethod), $method);
60+
}
61+
62+
#[DataProvider('validSpoofedMethodsProvider')]
63+
public function test_post_with_valid_method_is_spoofed(string $spoofedMethod): void
64+
{
65+
$request = $this->createServerRequest(
66+
'POST',
67+
['_method' => $spoofedMethod],
68+
);
69+
70+
$method = $this->requestMethod->invoke($this->mapper, $request, ['_method' => $spoofedMethod]);
71+
72+
$this->assertSame(Method::from(strtoupper($spoofedMethod)), $method);
73+
}
74+
75+
public function test_post_with_invalid_method_is_not_spoofed(): void
76+
{
77+
$request = $this->createServerRequest(
78+
'POST',
79+
['_method' => 'INVALID'],
80+
);
81+
82+
$method = $this->requestMethod->invoke($this->mapper, $request, ['_method' => 'INVALID']);
83+
84+
$this->assertSame(Method::POST, $method);
85+
}
86+
87+
public function test_method_param_is_case_insensitive(): void
88+
{
89+
$request = $this->createServerRequest(
90+
'POST',
91+
['_method' => 'delete'],
92+
);
93+
94+
$method = $this->requestMethod->invoke($this->mapper, $request, ['_method' => 'delete']);
95+
96+
$this->assertSame(Method::DELETE, $method);
97+
}
98+
99+
public static function nonPostMethodsProvider(): array
100+
{
101+
return [
102+
['GET'],
103+
['PUT'],
104+
['PATCH'],
105+
['DELETE'],
106+
['HEAD'],
107+
['OPTIONS'],
108+
['TRACE'],
109+
['CONNECT'],
110+
];
111+
}
112+
113+
public static function validSpoofedMethodsProvider(): array
114+
{
115+
return [
116+
['PUT'],
117+
['PATCH'],
118+
['DELETE'],
119+
];
120+
}
121+
122+
private function createEncrypter(): GenericEncrypter
123+
{
124+
return new GenericEncrypter(
125+
signer: new GenericSigner(
126+
config: new SigningConfig(
127+
algorithm: SigningAlgorithm::SHA256,
128+
key: 'my_secret_key',
129+
minimumExecutionDuration: false,
130+
),
131+
timelock: new Timelock(new GenericClock()),
132+
),
133+
config: new EncryptionConfig(
134+
algorithm: EncryptionAlgorithm::AES_256_GCM,
135+
key: 'my_secret_key',
136+
),
137+
);
138+
}
139+
140+
private function createServerRequest(string $method, array $body = []): ServerRequestInterface
141+
{
142+
$request = new ServerRequest([], [], '/', $method);
143+
144+
if ($body !== []) {
145+
$request = $request->withParsedBody($body);
146+
}
147+
148+
$stream = new Stream('php://temp', 'r+');
149+
$request = $request->withBody($stream);
150+
151+
return $request;
152+
}
153+
}

‎packages/view/src/Components/x-form.view.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,17 @@
1313
if ($method instanceof Method) {
1414
$method = $method->value;
1515
}
16+
17+
$needsSpoofing = Method::trySpoofingFrom($method) !== null;
18+
$formMethod = $needsSpoofing ? 'POST' : $method;
1619
?>
1720

18-
<form :action="$action" :method="$method" :enctype="$enctype">
21+
<form :action="$action" :method="$formMethod" :enctype="$enctype">
1922
<x-csrf-token />
2023

24+
<?php if ($needsSpoofing): ?>
25+
<input type="hidden" name="_method" value="<?= htmlspecialchars($method) ?>">
26+
<?php endif; ?>
27+
2128
<x-slot />
2229
</form>

0 commit comments

Comments
 (0)