6 ms·
Bittersweet Symfony: Devs accidentally turn off CSRF protection in PHP framework
- onnnon 5y agoThis issue was due to a change on how the default framework configuration was being set. The side effect was that if you didn't explicitly enable CSRF protection, it would default to being disabled. The issue was resolved/disclosed very quickly, and in a professional manor.
- lmilcin 5y agoProfessionalism, in my opinion, includes taking reasonable precautions to prevent the problem from happening. If you are professional you know what kind of potential problems might happen and you know what are reasonable possible approaches to handle it. If security of your piece of software relies on default values of some settings I would reasonably expect you to have automated tests to verify that these settings have correct values. Next time you hire an electrician who causes damage to your house because he did not follow procedure to wire it correctly, will you be still calling him "professional" because he quickly removed the short?
- lnxg33k1 5y agoI agree with you, but open source software is given as-is, in any context, if you see the headers and/or README files and/or LICENSE files, it says that there is no warranty given and considering that the whole (tech) world sustains itself on stealing the work of volounteers, I would reply that if a piece of software is not professional, then invest to make some professional work that works for you
- lmilcin 5y ago> I agree with you, but open source software is given as-is, in any context, But if you are calling somebody or something "professional" what you are saying is they act as if they were doing it in a certain way. If they don't follow the practices it does not matter if they are doing it for free. It is like saying a kid is doing something professionally (even if he is not) and argumenting that it is because he isn't paid for it.
- lnxg33k1 5y agoI think symfony developers are still good professionals, given the size of the project and the amount of contributors, having an error or not having a test case for something specific could be forgiven, I would reply that errors and bugs can slip in a codebase, I guess it's more important to create a test case to double check that a bug doesn't re-appear in the future after it has been fixed? I mean I fail to understand what are you trying to say, someone stops being a professional as soon as it hasn't covered a test case? Or are they kids just for having slipped a bug? Despite their work powers a lot of companies software (including the ones I work for) Are you just trolling?
- lmilcin 5y agoThe statement was that they acted professionally. I don't know if they are or are not professionals. It is just my opinion that being nice and prompt about removing cause of the damage after they have caused damage through recklessly ignoring industry standards cannot be reason to call their entire set of actions around this particular issue as "professional".
- jasonshaev 5y agoFYI, the GP comment said "The issue was resolved/disclosed very quickly, and in a professional manor." So they didn't say their "entire set of actions" was "professional" just that it was disclosed and resolved professionally.
- 420official 5y agoIt shows lack of experience to suggest having a gap in testing is somehow "recklessly ignoring industry standards". If you look at Symfony's test suite it's clear that they take testing extremely seriously and keep their tests up to date in a way that's far superior to my experience with "industry standard". If you look at the fix for this issue which is linked from the OP you'd see that the first thing they did is add a unit test to prevent this kind of issue from happening again. If you consider that kind of behavior recklessly unprofessional I'd be amazed to see the kind of tests you write for your code.
- alt227 5y agoEveryone makes mistakes. Its how you handle and rectify those mistakes which defines you.
- lmilcin 5y agoI very much disagree. Yes -- it is important how you rectify those mistakes. But being quick at rectifying mistakes does not yet make your actions professional.
- pfraze 5y agoExpectations of professionalism, software quality, process, and so on are all a matter of context. I'm not sure a FOSS web framework gets DQed for a quickly-rectified mistake. The expectations aren't that high and can't be that high.
- deleted 5y ago[deleted]
- mhitza 5y agoIs CSRF still a thing with SameSite cookies default Lax configuration nowadays? (ignoring when explicitly disabled)
- Techbrunch 5y agoIf you are using an up to date version of Firefox, Edge or Chrome it defaults to Lax. The exceptions are Safari, IE and Safari for IOS. I don't think this is worth a 8.1 CVSS. Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- diroussel 5y agoThere is certainly less need for it now as browsers have many more mitigations in place than when CSRf was first introduced. But I would say yes you still need it for defence in depth. For instance in RFC6749 (OAuth 2.0) it says clients MUST implement CSRF for the redirection step.
- mzs 5y agohttps://nvd.nist.gov/vuln/detail/CVE-2022-23601 https://nvd.nist.gov/vuln/detail/CVE-2022-23601
- tombert 5y agoMan, I haven't thought about Symfony in awhile. I took a job at a subcontracting about 9 years ago, where I was mostly doing Node.js work, but there were some projects using Symfony, and even after using it on/off for a month, I have to say I never really "got" it. I could tell there's something there that's fairly cool, but I never really was able to wrap my head around all the folders. I've become a way better programmer since then, so I have thought about trying it out again, but nothing in my day job uses PHP anymore, and I've moved away from web since then.
- benbristow 5y agoSymfony seems to be going strong still other than this issue. Laravel is the other big MVC framework for PHP.
- tombert 5y agoJust remembered, doesn't Laravel use a lot of Symfony components? If that's true then I have used it a bit since 2013, if only indirectly.
- mtberatwork 5y agoYes: https://packagist.org/packages/laravel/framework https://packagist.org/packages/laravel/framework
- skipnup 5y agoStill does, although you really don't notice while programming.
- throwaway2016a 5y agoCakePHP is also quite active and popular.
- benbristow 5y agoThat was quite popular a while back also. I tried to pick it up when I first got into web development and never really understood it (didn't really understand MVC at all) and started using CodeIgniter (which is also still going) instead which seemed more straight forward - although used it more like VC rather than MVC haha. Quite nice to see they're all going.
- twistedpair 5y agoGotta have those belts and suspenders. So many PRs people ask, why should we add protective measure X, when we already have protective measure Y? Defense in depth, my friends.
- wolpoli 5y agoUnfortunately, most people don't understand the technical nuance between protective measure X and Y will fall for it. People do seem to get the concept of defense in depth through when explained through the castle analogy.
- iqanq 5y agoDon't these people have tests?
- purerandomness 5y agoTests cannot prove the absence of bugs, ever.
- WJW 5y agoSure, but this was the presence of a bug. In a web framework you can easily have a test that fails when CSRF vulnerabilities are present. It's not some zeroday that has just been published, CSRF has been known for a very long time now. As a demo, here is a link to an 1100 line file full of such tests for the Rails framework: https://github.com/rails/rails/blob/main/actionpack/test/controller/request_forgery_protection_test.rb https://github.com/rails/rails/blob/main/actionpack/test/con...
- pictur 5y agogood question. obviously, such large libraries should have security tests independent of the existing tests.
- purerandomness 5y agoThey do, and the patch for this CVE adds a test case for this bug: https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50 https://github.com/symfony/symfony/commit/f0ffb775febdf07e57...
- Rygu 5y agoHere's the official blog: https://symfony.com/blog/cve-2022-23601-csrf-token-missing-in-forms https://symfony.com/blog/cve-2022-23601-csrf-token-missing-i...
- BiteCode_dev 5y agoA bit unrelated, but I find funny most frameworks don't even have something to prevent CSRF. Most devs don't even know what CSRF are, and some know it only as "the stuff I need to disable because some ajax POST won't work otherwise". In fact, every time somebody choose flask over Django, I ask what they are going to do about CSRF, only to get a blank stare. Same with manual PHP or using most nodejs web libs. There are so many websites that are vulnerable to this, and it's something we know well, and have solutions for. Imagine what we don't know about. The internet is really made of swiss cheese.
- vollmond 5y agoNow that you mention it, I can't think of any other concept I eventually researched and learned about just because of frameworks complaining (Spring framework in my case).
- jonathan-adly 5y agoWorking with Django has completely spoiled me as a dev. Now, I really can't stand manually configuring a lot of the "normal" good-practices that Django gives you for free.
- BiteCode_dev 5y agoXSS escaping, sql injection prevention, click-jacking protection, password hashing updates... Django provides so much security out of the box. That's before we even talk about features.
- sshine 5y agoNot for free. It just feels free because you already paid with your time to learn the conventions. :)
- tedivm 5y agoMost people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.
- pmarreck 5y agoImagine unit-testing the functionality you claim to provide. Oh, wait, it's PHP... Nevermind.
- anaganisk 5y agoA random library uses unsafe all along creating a lots of drama and drives author of said package into depression, ah never mind its rust. A random package author removes a package from npm breaking thousands of apps, never mind its Nodejs. A random package typo squats a famous package name making many apps vulnerable, never mind its python. A random logging library grants access to shell, never mind its Java. I could go on.
- daudmalik06 5y agoThis happens very often, Vulert.com is very useful in this case it notifies you as soon as a vulnerability found in any open source software you use.