Skip to content

Commit 607ee1a

Browse files
csmithcsmith
committed
Migrate away from gorilla/csrf
1 parent 2a7a0b7 commit 607ee1a

23 files changed

Lines changed: 96 additions & 38 deletions

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Changelog
22

3+
## 5.1.0 - 2025-12-01
4+
5+
* Migrate away from `gorilla/csrf` for CSRF protection
6+
* Minimum version of Go for building is now 1.25
7+
38
## 5.0.6 - 2025-05-09
49

510
_No code changes, just changes to the release process._

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ variables. The following configuration options are supported:
7575

7676
### Encryption key
7777

78-
In order to persist runtime settings (user accounts, session keys, CSRF tokens),
78+
In order to persist runtime settings (user accounts, session keys),
7979
you must provide an encryption key either as a CLI argument (`-key`) or
8080
an environment variable (`KEY`). The key should be 32 bytes and
8181
hex-encoded; you can generate such a key using `openssl rand -hex 32`.

‎config/secrets.go‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ const secretsSettingsName = "secrets"
99

1010
type Secrets struct {
1111
SessionKey []byte
12-
CsrfKey []byte
1312
}
1413

1514
func LoadSecrets(store Store) (*Secrets, error) {
@@ -29,15 +28,6 @@ func LoadSecrets(store Store) (*Secrets, error) {
2928
dirty = true
3029
}
3130

32-
if s.CsrfKey == nil || len(s.CsrfKey) < 32 {
33-
newKey := make([]byte, 32)
34-
if _, err := io.ReadFull(rand.Reader, newKey); err != nil {
35-
return nil, err
36-
}
37-
s.CsrfKey = newKey
38-
dirty = true
39-
}
40-
4131
if dirty {
4232
_ = store.PutSettings(secretsSettingsName, "System", "Initialising secrets", s)
4333
}

‎go.mod‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ go 1.25
55
require (
66
github.com/evanw/esbuild v0.27.0
77
github.com/go-git/go-git/v5 v5.16.4
8-
github.com/gorilla/csrf v1.7.3
98
github.com/gorilla/handlers v1.5.2
109
github.com/gorilla/mux v1.8.1
1110
github.com/gorilla/sessions v1.4.0

‎handlers_api.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ func ApiListHandler(l Lister) http.HandlerFunc {
1515
return func(w http.ResponseWriter, r *http.Request) {
1616
var res []string
1717

18+
if err := r.ParseForm(); err != nil {
19+
log.Printf("Error parsing form: %v", err)
20+
w.WriteHeader(http.StatusInternalServerError)
21+
return
22+
}
23+
1824
if r.FormValue("type") == "file" {
1925
files, err := l.ListFiles()
2026
if err != nil {

‎handlers_file.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,14 @@ package main
22

33
import (
44
"fmt"
5-
"github.com/mdbot/wiki/markdown"
65
"io"
76
"log"
87
"mime"
98
"net/http"
109
"path/filepath"
1110
"strings"
11+
12+
"github.com/mdbot/wiki/markdown"
1213
)
1314

1415
type FileLister interface {
@@ -115,6 +116,12 @@ func DeleteFileConfirmHandler(t *Templates) http.HandlerFunc {
115116

116117
func DeleteFileHandler(provider DeleteFileProvider) http.HandlerFunc {
117118
return func(writer http.ResponseWriter, request *http.Request) {
119+
if err := request.ParseForm(); err != nil {
120+
log.Printf("Error parsing form: %v", err)
121+
writer.WriteHeader(http.StatusInternalServerError)
122+
return
123+
}
124+
118125
name := strings.TrimPrefix(request.URL.Path, "/files/delete/")
119126
confirm := request.FormValue("confirm")
120127
if confirm == "" {

‎handlers_history.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,12 @@ type DiffProvider interface {
121121

122122
func DiffPageHandler(templates *Templates, backend DiffProvider) http.HandlerFunc {
123123
return func(w http.ResponseWriter, r *http.Request) {
124+
if err := r.ParseForm(); err != nil {
125+
log.Printf("Error parsing form: %v", err)
126+
w.WriteHeader(http.StatusInternalServerError)
127+
return
128+
}
129+
124130
pageTitle := strings.TrimPrefix(r.URL.Path, "/diff/")
125131
startRevision := r.FormValue("startrev")
126132
endRevision := r.FormValue("endrev")

‎handlers_page.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@ func ViewPageHandler(t *Templates, renderer ContentRenderer, pp PageProvider) ht
2424
return func(w http.ResponseWriter, r *http.Request) {
2525
pageTitle := strings.TrimPrefix(r.URL.Path, "/view/")
2626

27+
if err := r.ParseForm(); err != nil {
28+
log.Printf("Error parsing form: %v", err)
29+
w.WriteHeader(http.StatusInternalServerError)
30+
return
31+
}
32+
2733
revision := r.FormValue("rev")
2834
var page *Page
2935
var err error
@@ -74,6 +80,12 @@ func SubmitPageHandler(pe PageEditor) http.HandlerFunc {
7480
return func(writer http.ResponseWriter, request *http.Request) {
7581
pageTitle := strings.TrimPrefix(request.URL.Path, "/edit/")
7682

83+
if err := request.ParseForm(); err != nil {
84+
log.Printf("Error parsing form: %v", err)
85+
writer.WriteHeader(http.StatusInternalServerError)
86+
return
87+
}
88+
7789
content := request.FormValue("content")
7890
message := request.FormValue("message")
7991
username := "Anonymoose"
@@ -105,6 +117,13 @@ func DeletePageConfirmHandler(t *Templates) http.HandlerFunc {
105117
func DeletePageHandler(provider DeletePageProvider) http.HandlerFunc {
106118
return func(writer http.ResponseWriter, request *http.Request) {
107119
name := strings.TrimPrefix(request.URL.Path, "/delete/")
120+
121+
if err := request.ParseForm(); err != nil {
122+
log.Printf("Error parsing form: %v", err)
123+
writer.WriteHeader(http.StatusInternalServerError)
124+
return
125+
}
126+
108127
confirm := request.FormValue("confirm")
109128
if confirm == "" {
110129
http.Redirect(writer, request, "/delete/"+name, http.StatusSeeOther)
@@ -142,6 +161,12 @@ func RenamePageConfirmHandler(backend PageExists, t *Templates) http.HandlerFunc
142161

143162
func RenamePageHandler(provider RenamePageProvider) http.HandlerFunc {
144163
return func(writer http.ResponseWriter, request *http.Request) {
164+
if err := request.ParseForm(); err != nil {
165+
log.Printf("Error parsing form: %v", err)
166+
writer.WriteHeader(http.StatusInternalServerError)
167+
return
168+
}
169+
145170
name := strings.TrimPrefix(request.URL.Path, "/rename/")
146171
newName := request.FormValue("newName")
147172
if newName == "" {
@@ -168,6 +193,12 @@ type RevertPageProvider interface {
168193

169194
func RevertPageConfirmHandler(t *Templates) http.HandlerFunc {
170195
return func(w http.ResponseWriter, r *http.Request) {
196+
if err := r.ParseForm(); err != nil {
197+
log.Printf("Error parsing form: %v", err)
198+
w.WriteHeader(http.StatusInternalServerError)
199+
return
200+
}
201+
171202
name := strings.TrimPrefix(r.URL.Path, "/revert/")
172203
revision := r.FormValue("rev")
173204
if revision == "" {
@@ -180,6 +211,12 @@ func RevertPageConfirmHandler(t *Templates) http.HandlerFunc {
180211

181212
func RevertPageHandler(provider RevertPageProvider) http.HandlerFunc {
182213
return func(writer http.ResponseWriter, request *http.Request) {
214+
if err := request.ParseForm(); err != nil {
215+
log.Printf("Error parsing form: %v", err)
216+
writer.WriteHeader(http.StatusInternalServerError)
217+
return
218+
}
219+
183220
name := strings.TrimPrefix(request.URL.Path, "/revert/")
184221
confirm := request.FormValue("confirm")
185222
if confirm == "" {

‎handlers_search.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package main
22

33
import (
4+
"log"
45
"net/http"
56
)
67

@@ -10,6 +11,12 @@ type SearchRequest interface {
1011

1112
func SearchHandler(templates *Templates, backend SearchRequest) http.HandlerFunc {
1213
return func(w http.ResponseWriter, r *http.Request) {
14+
if err := r.ParseForm(); err != nil {
15+
log.Printf("Error parsing form: %v", err)
16+
w.WriteHeader(http.StatusInternalServerError)
17+
return
18+
}
19+
1320
pattern := r.FormValue("pattern")
1421
var results []SearchResult
1522
if pattern != "" {

‎handlers_user.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package main
22

33
import (
44
"fmt"
5+
"log"
56
"net/http"
67
"sort"
78
"strings"
@@ -15,6 +16,12 @@ type Authenticator interface {
1516

1617
func LoginHandler(auth Authenticator) http.HandlerFunc {
1718
return func(writer http.ResponseWriter, request *http.Request) {
19+
if err := request.ParseForm(); err != nil {
20+
log.Printf("Error parsing form: %v", err)
21+
writer.WriteHeader(http.StatusInternalServerError)
22+
return
23+
}
24+
1825
username := request.FormValue("username")
1926
password := request.FormValue("password")
2027
redirect := request.FormValue("redirect")
@@ -38,6 +45,12 @@ func LoginHandler(auth Authenticator) http.HandlerFunc {
3845

3946
func LogoutHandler() http.HandlerFunc {
4047
return func(writer http.ResponseWriter, request *http.Request) {
48+
if err := request.ParseForm(); err != nil {
49+
log.Printf("Error parsing form: %v", err)
50+
writer.WriteHeader(http.StatusInternalServerError)
51+
return
52+
}
53+
4154
redirect := request.FormValue("redirect")
4255

4356
// Only allow relative redirects
@@ -96,6 +109,12 @@ func ModifyUserHandler(um UserModifier) http.HandlerFunc {
96109
responsible = user.Name
97110
}
98111

112+
if err := request.ParseForm(); err != nil {
113+
log.Printf("Error parsing form: %v", err)
114+
writer.WriteHeader(http.StatusInternalServerError)
115+
return
116+
}
117+
99118
user := request.FormValue("user")
100119
action := request.FormValue("action")
101120
if action == "password" {
@@ -155,6 +174,12 @@ func ModifyAccountHandler(pu PasswordUpdater) http.HandlerFunc {
155174
return
156175
}
157176

177+
if err := request.ParseForm(); err != nil {
178+
log.Printf("Error parsing form: %v", err)
179+
writer.WriteHeader(http.StatusInternalServerError)
180+
return
181+
}
182+
158183
action := request.FormValue("action")
159184
if action == "password" {
160185
if _, err := pu.Authenticate(user.Name, request.FormValue("password")); err != nil {

0 commit comments

Comments
 (0)