Check the content type when replacing tokens

contao · Sep 5, 2019 · 7982b80 · Toflar · Sep 5, 2019 · leofeyer
1 parent 51a69b1
commit 7982b80
Show file tree

Hide file tree

Showing 2 changed files with 77 additions and 18 deletions.
diff --git a/core-bundle/src/EventListener/CsrfTokenCookieListener.php b/core-bundle/src/EventListener/CsrfTokenCookieListener.php
@@ -117,6 +117,11 @@ private function setCookies(Request $request, Response $response): void
 
     private function replaceTokenOccurrences(Response $response): void
     {
+        // Return if the response is not a HTML document
+        if (false === stripos((string) $response->headers->get('Content-Type'), 'text/html')) {
+            return;
+        }
+
         $content = $response->getContent();
 
         foreach ($this->tokenStorage->getUsedTokens() as $value) {

diff --git a/core-bundle/tests/EventListener/CsrfTokenCookieListenerTest.php b/core-bundle/tests/EventListener/CsrfTokenCookieListenerTest.php
@@ -15,6 +15,7 @@
 use Contao\CoreBundle\Csrf\MemoryTokenStorage;
 use Contao\CoreBundle\EventListener\CsrfTokenCookieListener;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\ParameterBag;
 use Symfony\Component\HttpFoundation\Request;
@@ -210,24 +211,6 @@ public function testRemovesTheTokenCookiesAndReplacesTokenOccurrencesIfNoOtherCo
             ->willReturn(true)
         ;
 
-        $response = new Response('<html><body><form><input name="REQUEST_TOKEN" value="tokenValue"></form></body></html>');
-
-        $responseEvent = $this->createMock(FilterResponseEvent::class);
-        $responseEvent
-            ->method('isMasterRequest')
-            ->willReturn(true)
-        ;
-
-        $responseEvent
-            ->method('getRequest')
-            ->willReturn($request)
-        ;
-
-        $responseEvent
-            ->method('getResponse')
-            ->willReturn($response)
-        ;
-
         $responseHeaders = $this->createMock(ResponseHeaderBag::class);
         $responseHeaders
             ->expects($this->never())
@@ -245,8 +228,32 @@ public function testRemovesTheTokenCookiesAndReplacesTokenOccurrencesIfNoOtherCo
             ->with('csrf_foo')
         ;
 
+        $responseHeaders
+            ->expects($this->once())
+            ->method('get')
+            ->with('Content-Type')
+            ->willReturn('text/html')
+        ;
+
+        $response = new Response('<html><body><form><input name="REQUEST_TOKEN" value="tokenValue"></form></body></html>');
         $response->headers = $responseHeaders;
 
+        $responseEvent = $this->createMock(FilterResponseEvent::class);
+        $responseEvent
+            ->method('isMasterRequest')
+            ->willReturn(true)
+        ;
+
+        $responseEvent
+            ->method('getRequest')
+            ->willReturn($request)
+        ;
+
+        $responseEvent
+            ->method('getResponse')
+            ->willReturn($response)
+        ;
+
         $tokenStorage = new MemoryTokenStorage();
         $tokenStorage->initialize(['tokenName' => 'tokenValue']);
         $tokenStorage->getToken('tokenName');
@@ -282,4 +289,51 @@ public function testDoesNotAddTheTokenCookiesToTheResponseUponSubrequests(): voi
         $listener = new CsrfTokenCookieListener($tokenStorage);
         $listener->onKernelResponse($responseEvent);
     }
+
+    public function testDoesNotReplaceTheTokenOccurrencesIfNotAHtmlDocument(): void
+    {
+        $request = $this->createMock(Request::class);
+        $request->cookies = new ParameterBag();
+
+        $responseHeaders = $this->createMock(ResponseHeaderBag::class);
+        $responseHeaders
+            ->method('getCookies')
+            ->willReturn([])
+        ;
+
+        $responseHeaders
+            ->expects($this->once())
+            ->method('get')
+            ->with('Content-Type')
+            ->willReturn('application/octet-stream')
+        ;
+
+        $response = $this->createMock(BinaryFileResponse::class);
+        $response->headers = $responseHeaders;
+
+        $responseEvent = $this->createMock(FilterResponseEvent::class);
+        $responseEvent
+            ->method('isMasterRequest')
+            ->willReturn(true)
+        ;
+
+        $responseEvent
+            ->method('getRequest')
+            ->willReturn($request)
+        ;
+
+        $responseEvent
+            ->method('getResponse')
+            ->willReturn($response)
+        ;
+
+        $tokenStorage = $this->createMock(MemoryTokenStorage::class);
+        $tokenStorage
+            ->expects($this->never())
+            ->method('getUsedTokens')
+        ;
+
+        $listener = new CsrfTokenCookieListener($tokenStorage);
+        $listener->onKernelResponse($responseEvent);
+    }
 }