legacy/csrf - remove Phalcon\Encryption\Security\Random dependency fo…

…r a simple Csrf class offering the same random url safe base64 encoded string.

plist

@@ -508,6 +508,7 @@
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/Backend.php
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/Config.php
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/ConfigException.php
+/usr/local/opnsense/mvc/app/library/OPNsense/Core/Csrf.php
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/File.php
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/FileObject.php
 /usr/local/opnsense/mvc/app/library/OPNsense/Core/Routing.php

src/opnsense/mvc/app/library/OPNsense/Core/Csrf.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Core;
+
+class Csrf
+{
+    /**
+     * Generate a random URL-safe base64 string.
+     * Usable base64 characters according to https://www.ietf.org/rfc/rfc3548.txt
+     */
+    public function base64Safe($len=16)
+    {
+        return rtrim(strtr(base64_encode(random_bytes($len)), "+/", "-_"), '=');
+    }
+
+    public function getToken()
+    {
+        // only request new token when session has none
+        if (session_status() == PHP_SESSION_NONE) {
+            // our session is not guaranteed to be started at this point.
+            session_start();
+        }
+        if (empty($_SESSION['$PHALCON/CSRF/KEY$']) || empty($_SESSION['$PHALCON/CSRF$'])) {
+            $_SESSION['$PHALCON/CSRF$'] = $this->base64Safe(16);
+            $_SESSION['$PHALCON/CSRF/KEY$'] = $this->base64Safe(16);
+        }
+        return [
+            'token' => $_SESSION['$PHALCON/CSRF$'],
+            'key' => $_SESSION['$PHALCON/CSRF/KEY$']
+        ];
+    }
+}

src/www/csrf.inc

@@ -69,29 +69,14 @@ class LegacyCSRF
         return $result;
     }
 
-    private function newToken()
-    {
-        $random = new \Phalcon\Encryption\Security\Random();
-        // only request new token when session has none
-        if (session_status() == PHP_SESSION_NONE) {
-            // our session is not guaranteed to be started at this point.
-            session_start();
-        }
-        if (empty($_SESSION['$PHALCON/CSRF/KEY$']) || empty($_SESSION['$PHALCON/CSRF$'])) {
-            $_SESSION['$PHALCON/CSRF$'] = $random->base64Safe(16);
-            $_SESSION['$PHALCON/CSRF/KEY$'] = $random->base64Safe(16);
-        }
-        return array('token' => $_SESSION['$PHALCON/CSRF$'], 'key' => $_SESSION['$PHALCON/CSRF/KEY$']);
-    }
-
     public function csrfRewriteHandler($buffer)
     {
         // quick check if output looks like html, don't rewrite other document types
         if (stripos($buffer, '<html') !== false) {
             $this->is_html_output = true;
         }
         if ($this->is_html_output) {
-            $csrf = $this->newToken();
+            $csrf = (new OPNsense\Core\Csrf())->getToken();
             $inputtag = "<input type=\"hidden\" name=\"{$csrf['key']}\" value=\"{$csrf['token']}\" autocomplete=\"new-password\" />";
             $buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $inputtag, $buffer);
             // csrf token for Ajax type requests