register csrf string
350207
public function registerCSRFString()
    {
        mt_srand(time());
        $string = md5(mt_rand().'_'.time().'_'.mt_rand().'_'.mt_rand());
        $_SESSION[$this->csrfTokenString] = $string;
    }
1244909
def query(query_str)
      # puts "conent #{content}"
      res = conn.post '/query/', {query: query_str, time: Time.now.to_i}.to_json do |req|
        req.headers['Content-Type'] = 'application/json'
        req.headers['X-Requested-With'] = 'XMLHttpRequest'
        req['Cookie'] = "csrftoken=#{csrf_token}"
        req.headers['X-CSRFToken'] = csrf_token
      end
      JSON.parse(res.body)
   end
232783
public void saveToken(CsrfToken t, HttpServletRequest request, HttpServletResponse response) {
		String ident = getIdentifierFromCookie(request);
		if (ident != null) {
			String key = ident.concat(parameterName);
			CsrfToken token = loadToken(request);
			if (token == null) {
				token = generateToken(null);
				if (Config.isCacheEnabled()) {
					cache.put(Config.getRootAppIdentifier(), key, token, (long) Config.SESSION_TIMEOUT_SEC);
				} else {
					localCache.put(key, new Object[]{token, System.currentTimeMillis()});
				}
			}
			storeTokenAsCookie(token, request, response);
		}
	}
366454
public function validateCsrf()
    {
        $tokenService = $this->getServiceLocator()->get(TokenService::SERVICE_ID);

        $tokenName = $tokenService->getTokenName();
        $token = $this->getRequestParameter($tokenName);

        if ( $tokenService->checkToken($token) ) {
            $tokenService->revokeToken($token);
            $newToken = $tokenService->createToken();
            $this->setCookie($tokenName, $newToken, null, '/');
            return true;
        }

        \common_Logger::w('Csrf validation failed');
        throw new \common_exception_Unauthorized();
    }
1025587
public function endForm(): void
    {
        $useCsrf = (isset($this->formOptions['use_csrf'])) ?
            filter_var($this->formOptions['use_csrf'], FILTER_VALIDATE_BOOLEAN)
            : true;

        $tokenField = ($useCsrf) ? HtmlTag::createElement('input')
            ->set('id', 'csrf_token')
            ->set('name', 'csrf_token')
            ->set('type', 'hidden')
            ->set('value', $this->generateCsrfToken())
            : '';

        echo $tokenField . '</form>';
    }
446215
function getCsrf (opts) {
  // for testing
  if (opts._simulateMaintenance) {
    return new Promise((resolve, reject) => {
      setTimeout(() => {
        reject(new Error('Could not find CSRF token'))
      }, 300)
    })
  }

  return fetch(`${opts.host}/_/mobile/init`, json(opts))
    .then((response) => props({
      csrf: getJSON(response).then((body) => body.data[0].c),
      session: getSessionCookie(response.headers.get('set-cookie'))
    }))
}
1227968
def ValidateCSRFTokenOrRaise(request):
  """"""

  # CSRF check doesn't make sense for GET/HEAD methods, because they can
  # (and are) used when downloading files through <a href> links - and
  # there's no way to set X-CSRFToken header in this case.
  if request.method in ("GET", "HEAD"):
    return

  # In the ideal world only JavaScript can be used to add a custom header, and
  # only within its origin. By default, browsers don't allow JavaScript to
  # make cross origin requests.
  #
  # Unfortunately, in the real world due to bugs in browsers plugins, it can't
  # be guaranteed that a page won't set an HTTP request with a custom header
  # set. That's why we also check the contents of a header via an HMAC check
  # with a server-stored secret.
  #
  # See for more details:
  # https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
  # (Protecting REST Services: Use of Custom Request Headers).
  csrf_token = request.headers.get("X-CSRFToken", "").encode("ascii")
  if not csrf_token:
    logging.info("Did not find headers CSRF token for: %s", request.path)
    raise werkzeug_exceptions.Forbidden("CSRF token is missing")

  try:
    decoded = base64.urlsafe_b64decode(csrf_token + b"==")
    digest, token_time = decoded.rsplit(CSRF_DELIMITER, 1)
    token_time = int(token_time)
  except (TypeError, ValueError):
    logging.info("Malformed CSRF token for: %s", request.path)
    raise werkzeug_exceptions.Forbidden("Malformed CSRF token")

  if len(digest) != hashlib.sha256().digest_size:
    logging.info("Invalid digest size for: %s", request.path)
    raise werkzeug_exceptions.Forbidden("Malformed CSRF token digest")

  expected = GenerateCSRFToken(request.user, token_time)
  if not constant_time.bytes_eq(csrf_token, expected):
    logging.info("Non-matching CSRF token for: %s", request.path)
    raise werkzeug_exceptions.Forbidden("Non-matching CSRF token")

  current_time = rdfvalue.RDFDatetime.Now().AsMicrosecondsSinceEpoch()
  if current_time - token_time > CSRF_TOKEN_DURATION.microseconds:
    logging.info("Expired CSRF token for: %s", request.path)
    raise werkzeug_exceptions.Forbidden("Expired CSRF token")
410232
def Register():
  """"""
  # pyformat: disable

  # Command parsers.
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Dpkg", linux_cmd_parser.DpkgCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Dmidecode", linux_cmd_parser.DmidecodeCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Mount", config_file.MountCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "OsxSpHardware", osx_file_parser.OSXSPHardwareDataTypeParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Ps", linux_cmd_parser.PsCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Rpm", linux_cmd_parser.RpmCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "SshdConfig", config_file.SshdConfigCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Sysctl", linux_sysctl_parser.SysctlCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "YumList", linux_cmd_parser.YumListCmdParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "YumRepolist", linux_cmd_parser.YumRepolistCmdParser)

  # Grep parsers.
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Passwd", linux_file_parser.PasswdBufferParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "Netgroup", linux_file_parser.NetgroupBufferParser)

  # WMI query parsers.
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiEventConsumer", wmi_parser.WMIEventConsumerParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiInstalledSoftware", wmi_parser.WMIInstalledSoftwareParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiHotfixesSoftware", wmi_parser.WMIHotfixesSoftwareParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiUser", wmi_parser.WMIUserParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiLogicalDisks", wmi_parser.WMILogicalDisksParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiCsp", wmi_parser.WMIComputerSystemProductParser)
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WmiInterfaces", wmi_parser.WMIInterfacesParser)

  # Registry value parsers.
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinCcs", windows_registry_parser.CurrentControlSetKBParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinCodepage", windows_registry_parser.CodepageParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinEnvironment", windows_registry_parser.WinEnvironmentParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinServices", windows_registry_parser.WinServicesParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinSystemDrive", windows_registry_parser.WinSystemDriveParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinSystemRoot", windows_registry_parser.WinSystemRootParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinTimezone", windows_registry_parser.WinTimezoneParser)

  # Registry parsers.
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinAllUsersProfileEnvVar",
      windows_registry_parser.AllUsersProfileEnvironmentVariable)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinProfileDirEnvVar",
      windows_registry_parser.ProfilesDirectoryEnvironmentVariable)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WinUserSids",
      windows_registry_parser.WinUserSids)

  # Artifact file parsers.
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "DarwinPersistenceMechanism",
      osx_launchd.DarwinPersistenceMechanismsParser)
  parsers.SINGLE_RESPONSE_PARSER_FACTORY.Register(
      "WindowsPersistenceMechanism",
      windows_persistence.WindowsPersistenceMechanismsParser)

  # Registry multi-parsers.
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "WinUserSpecialDirs", windows_registry_parser.WinUserSpecialDirs)

  # Artifact file multi-parsers.
  parsers.MULTI_RESPONSE_PARSER_FACTORY.Register(
      "OsxUsers", osx_file_parser.OSXUsersParser)

  # File parsers.
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "ChromeHistory", chrome_history.ChromeHistoryParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "CronAtAllAllowDeny", config_file.CronAtAllowDenyParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "CronTab", cron_file_parser.CronTabParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "FirefoxHistory", firefox3_history.FirefoxHistoryParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "IeHistory", ie_history.IEHistoryParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "LinuxWtmp", linux_file_parser.LinuxWtmpParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Mtab", config_file.MtabParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Netgroup", linux_file_parser.NetgroupParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "NfsExports", config_file.NfsExportsParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Ntpd", config_file.NtpdParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "PackageSource", config_file.PackageSourceParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Passwd", linux_file_parser.PasswdParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Path", linux_file_parser.PathParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "SshdConfigFile", config_file.SshdConfigParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "Sudoers", config_file.SudoersParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "OsxLaunchdPlist", osx_file_parser.OSXLaunchdPlistParser)
  parsers.SINGLE_FILE_PARSER_FACTORY.Register(
      "OSXInstallHistoryPlist", osx_file_parser.OSXInstallHistoryPlistParser)

  try:
    from debian import deb822  # pylint: disable=g-import-not-at-top
    parsers.SINGLE_FILE_PARSER_FACTORY.Register(
        "DpkgStatusParser",
        lambda: linux_software_parser.DebianPackagesStatusParser(deb822))
  except ImportError:
    pass


  # File multi-parsers.
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxBaseShadow", linux_file_parser.LinuxBaseShadowParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxLsbInit", linux_service_parser.LinuxLSBInitParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxXinetd", linux_service_parser.LinuxXinetdParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxSysvInit", linux_service_parser.LinuxSysVInitParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxPam", linux_pam_parser.PAMParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "LinuxReleaseInfo", linux_release_parser.LinuxReleaseParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "PciDevicesInfo", linux_file_parser.PCIDevicesInfoParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "ProcSys", linux_sysctl_parser.ProcSysParser)
  parsers.MULTI_FILE_PARSER_FACTORY.Register(
      "Rsyslog", config_file.RsyslogParser)
1091458
protected function generateCsrfToken()
    {
        $token = $this->app->getSecurity()->generateRandomString();
        if ($this->enableCsrfCookie) {
            $cookie = $this->createCsrfCookie($token);
            $this->app->getResponse()->getCookies()->add($cookie);
        } else {
            $this->app->getSession()->set($this->csrfParam, $token);
        }

        return $token;
    }
365184
def masked_authenticity_token(session, form_options: {}) # :doc:
        action, method = form_options.values_at(:action, :method)

        raw_token = if per_form_csrf_tokens && action && method
          action_path = normalize_action_path(action)
          per_form_csrf_token(session, action_path, method)
        else
          real_csrf_token(session)
        end

        one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
        encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
        masked_token = one_time_pad + encrypted_csrf_token
        Base64.strict_encode64(masked_token)
      end
266032
private function _csrf_validate()
    {

        // if CSRF protection is enabled (is not boolean FALSE)
        if ($this->form_properties['csrf_storage_method'] !== false) {

            // reference to the form submission method
            global ${'_' . $this->form_properties['method']};

            $method = & ${'_' . $this->form_properties['method']};

            // if
            if (

                // the hidden field with the CSRF token was submitted
                isset($method[$this->form_properties['csrf_token_name']]) && (

                    // CSRF token is stored in a session variable
                    ($this->form_properties['csrf_storage_method'] == 'session' &&
                    // the session variable exists
                    isset($_SESSION[$this->form_properties['csrf_cookie_name']]) &&
                    // the session variable holds an array
                    is_array($_SESSION[$this->form_properties['csrf_cookie_name']]) &&
                    // the array has 2 entries
                    count($_SESSION[$this->form_properties['csrf_cookie_name']]) == 2 &&
                    // the value of the hidden field and the value in the session match
                    $method[$this->form_properties['csrf_token_name']] == $_SESSION[$this->form_properties['csrf_cookie_name']][0] &&
                    // if CSRF token doesn't expire or it does but it didn't yet
                    ($_SESSION[$this->form_properties['csrf_cookie_name']][1] == 0 || $_SESSION[$this->form_properties['csrf_cookie_name']][1] > time()))

                    ||

                    // CSRF token is stored in a cookie
                    ($this->form_properties['csrf_storage_method'] == 'cookie' &&
                    // the cookie exists
                    isset($_COOKIE[$this->form_properties['csrf_cookie_name']]) &&
                    // the value of the hidden field and the value in the cookie match
                    $method[$this->form_properties['csrf_token_name']] == $_COOKIE[$this->form_properties['csrf_cookie_name']])

                )

            // everything seems in order, then
            ) return true;

            // if we get here something was fishy...
            return false;

        }

        // if protection against CSRF attacks is not enabled, pretend nothing happened
        return true;

    }
667432
def csrf_protect(f):
    """"""

    @wraps(f)
    def wrapper(*args, **kwargs):
        token = session.get("csrf_token", None)
        if token is None or token != request.environ.get("HTTP_X_CSRFTOKEN"):
            logger.warning("Received invalid csrf token. Aborting")
            abort(403)
        # call original request handler
        return f(*args, **kwargs)

    return wrapper
969029
function (options) {
    var ignore = options.ignore || [],
        csrf = csurf(options),
        always = {OPTIONS: 1, GET: 1, HEAD: 1};

    return function (req, res, next) {
      if (always[req.method]) {
        return csrf(req, res, next);
      } else {
        var url = parse(req.url);
        var skipCSRF = false;
        ignore.forEach(function(matcher) {
          if (typeof matcher === 'string') {
            if (matcher === url.pathname) {
              skipCSRF = true;
            }
          } else {
            // regular expression matcher
            if (url.pathname.match(matcher)) {
              skipCSRF = true;
            }
          }
        });

        if (skipCSRF) {
          next();
        } else {
          return csrf(req, res, next);
        }
      }
    };
  }
565452
public function createCsrfField()
    {
        $fieldName = Config::get('security.csrf.field_name');

        $input = new Input($this->form->expression('input'), [
            'name' => $fieldName,
            'value' => $this->createToken(),
            'type' => 'hidden'
        ]);

        return $input->execute();
    }
574310
public function GetCsrf () {
		$session = & $this->getSession();
		list($name, $value) = $session->csrf;
		return (object) ['name' => $name, 'value' => $value];
	}
281060
def store_csrf_tokens(response)
      if response && response.headers
        tokens = response.headers.select { |k, v| %w(csrf csrf_ts).include?(k) }
        if tokens && !tokens.empty?
          @csrf_tokens = tokens
        end
      end
    end
1272386
def csrf(request):
    
    def _get_val():
        token = get_token(request)
        if token is None:
            # In order to be able to provide debugging info in the
            # case of misconfiguration, we use a sentinel value
            # instead of returning an empty dict.
            return 'NOTPROVIDED'
        else:
            token = force_bytes(token, encoding='latin-1')
            key = force_bytes(
                get_random_string(len(token)),
                encoding='latin-1'
            )
            value = b64_encode(xor(token, key))
            return force_text(b'$'.join((key, value)), encoding='latin-1')
    _get_val = lazy(_get_val, text_type)

    return {'csrf_token': _get_val()}