fix: Honeypot field appears when CSP is enabled #7029

kenjis · 2022-12-27T05:48:23Z

Description
From https://forum.codeigniter.com/showthread.php?tid=85960

fix bug
add Config\Honeypot::$containerId

How to Test

diff --git a/app/Config/App.php b/app/Config/App.php
index 0a23462b6..e8f314371 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -446,5 +446,5 @@ class App extends BaseConfig
      * @see http://www.html5rocks.com/en/tutorials/security/content-security-policy/
      * @see http://www.w3.org/TR/CSP/
      */
-    public bool $CSPEnabled = false;
+    public bool $CSPEnabled = true;
 }
diff --git a/app/Config/Filters.php b/app/Config/Filters.php
index 7b70c4fb3..12bb9619c 100644
--- a/app/Config/Filters.php
+++ b/app/Config/Filters.php
@@ -29,13 +29,13 @@ class Filters extends BaseConfig
      */
     public array $globals = [
         'before' => [
-            // 'honeypot',
+            'honeypot',
             // 'csrf',
             // 'invalidchars',
         ],
         'after' => [
             'toolbar',
-            // 'honeypot',
+            'honeypot',
             // 'secureheaders',
         ],
     ];
diff --git a/app/Controllers/Home.php b/app/Controllers/Home.php
index 7f867e95f..c451f5302 100644
--- a/app/Controllers/Home.php
+++ b/app/Controllers/Home.php
@@ -6,6 +6,6 @@ class Home extends BaseController
 {
     public function index()
     {
-        return view('welcome_message');
+        return '<head></head><form></form>';
     }
 }

You will see Fill This Field before this PR.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

…h CSP

kenjis · 2022-12-27T06:59:52Z

tests/system/Honeypot/HoneypotTest.php

+
+        $config             = new App();
+        $config->CSPEnabled = true;
+        Factories::injectMock('config', 'App', $config);


Because CodeIgniter\HTTP\ContentSecurityPolicy depends on config('App')
(and Response pulls Services::csp()), we must inject Config\App into the Factories.

Thanks for the explanation! We can also just use the factory version here:

config('App')->CSPEnabled = true;

But nothing wrong with the explicit version.

Factories are reset each time during tests, so there is probably no problem with that way.
However, I do not think it is healthy that most framework classes depend on Factories (config()).

It's not easy to get rid of this dependency now, but I would like to reduce it if possible.

MGatner

Looks good! One typo.

You sent this to 4.3 - is that your vote that we release 4.3 next? I believe we're ready.

app/Config/Honeypot.php

MGatner · 2022-12-27T12:21:29Z

tests/system/Honeypot/HoneypotTest.php

+
+        $config             = new App();
+        $config->CSPEnabled = true;
+        Factories::injectMock('config', 'App', $config);


Thanks for the explanation! We can also just use the factory version here:

config('App')->CSPEnabled = true;

But nothing wrong with the explicit version.

Co-authored-by: MGatner <[email protected]>

kenjis · 2022-12-28T00:16:43Z

You sent this to 4.3 - is that your vote that we release 4.3 next? I believe we're ready.

I sent to 4.3 because this needs a new Config item.

We merged two bug fixes into develop, so I would like to release v4.2.12 before v4.3.0.

kenjis added 6 commits December 27, 2022 14:16

refactor: remove / before > in input tag

0a9947e

fix: inline style "display:none" for honeypot field does not work wit…

b7ef46c

…h CSP

docs: fix section level

87a677e

docs: fix text decoration

53380f4

docs: update sample Config file

0c25173

docs: add config items

184dd46

kenjis added bug Verified issues on the current code behavior or pull requests that will fix them 4.3 labels Dec 27, 2022

kenjis added 4 commits December 27, 2022 15:15

docs: add changelog and upgrading guide

ee49833

test: use aliasing with use operator

221b9ac

test: update expected

3c339cd

test: add test

4643580

kenjis commented Dec 27, 2022

View reviewed changes

MGatner requested changes Dec 27, 2022

View reviewed changes

michalsn approved these changes Dec 27, 2022

View reviewed changes

docs: fix typo

4a1d91e

Co-authored-by: MGatner <[email protected]>

MGatner approved these changes Dec 29, 2022

View reviewed changes

kenjis merged commit b86e62c into codeigniter4:4.3 Jan 5, 2023

kenjis deleted the fix-honeypot-csp-bug branch January 5, 2023 01:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Honeypot field appears when CSP is enabled #7029

fix: Honeypot field appears when CSP is enabled #7029

kenjis commented Dec 27, 2022 •

edited

Loading

kenjis Dec 27, 2022 •

edited

Loading

MGatner Dec 27, 2022

kenjis Dec 28, 2022 •

edited

Loading

MGatner left a comment

MGatner Dec 27, 2022

kenjis commented Dec 28, 2022

fix: Honeypot field appears when CSP is enabled #7029

fix: Honeypot field appears when CSP is enabled #7029

Conversation

kenjis commented Dec 27, 2022 • edited Loading

How to Test

kenjis Dec 27, 2022 • edited Loading

Choose a reason for hiding this comment

MGatner Dec 27, 2022

Choose a reason for hiding this comment

kenjis Dec 28, 2022 • edited Loading

Choose a reason for hiding this comment

MGatner left a comment

Choose a reason for hiding this comment

MGatner Dec 27, 2022

Choose a reason for hiding this comment

kenjis commented Dec 28, 2022

kenjis commented Dec 27, 2022 •

edited

Loading

kenjis Dec 27, 2022 •

edited

Loading

kenjis Dec 28, 2022 •

edited

Loading