OC::performSameSiteCookieProtection()

Complexity

Conditions	9
Paths	14

Size

Total Lines	45
Code Lines	21

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	private static function performSameSiteCookieProtection(\OCP\IConfig $config): void {
		$request = Server::get(IRequest::class);

		// Some user agents are notorious and don't really properly follow HTTP
		// specifications. For those, have an automated opt-out. Since the protection
		// for remote.php is applied in base.php as starting point we need to opt out
		// here.
		$incompatibleUserAgents = $config->getSystemValue('csrf.optout');

		// Fallback, if csrf.optout is unset
		if (!is_array($incompatibleUserAgents)) {
			$incompatibleUserAgents = [
				// OS X Finder
				'/^WebDAVFS/',
				// Windows webdav drive
				'/^Microsoft-WebDAV-MiniRedir/',
			];
		}

		if ($request->isUserAgent($incompatibleUserAgents)) {
			return;
		}

		if (count($_COOKIE) > 0) {
			$requestUri = $request->getScriptName();
			$processingScript = explode('/', $requestUri);
			$processingScript = $processingScript[count($processingScript) - 1];

			// index.php routes are handled in the middleware
			if ($processingScript === 'index.php') {
				return;
			}

			// All other endpoints require the lax and the strict cookie
			if (!$request->passesStrictCookieCheck()) {
				self::sendSameSiteCookies();
				// Debug mode gets access to the resources without strict cookie
				// due to the fact that the SabreDAV browser also lives there.
				if (!$config->getSystemValue('debug', false)) {
					http_response_code(\OCP\AppFramework\Http::STATUS_SERVICE_UNAVAILABLE);
					exit();

Using exit here is not recommended.

				}
			}
		} elseif (!isset($_COOKIE['nc_sameSiteCookielax']) || !isset($_COOKIE['nc_sameSiteCookiestrict'])) {
			self::sendSameSiteCookies();
		}