SameOrigin validation fails with custom Nette\Http\IRequest implementation

[janfejtek]

Version: 3.3.0

Bug Description

Form validation for received signal $presenter->getHttpRequest()->isFrom(Nette\Http\FetchSite::SameOrigin) fails if custom Request class is used. Calling isFrom is not possible on IRequest interface as it does not exist

application/src/Application/UI/Form.php

Lines 144 to 146 in b670493

	} elseif (!$this->crossOrigin && !$presenter->getHttpRequest()->isFrom(Nette\Http\FetchSite::SameOrigin)) {
	$presenter->detectedCsrf();

Steps To Reproduce

For example PHPStan or just add custom class implementing https://github.com/nette/http/blob/master/src/Http/IRequest.php

Expected Behavior

Do not throw exception when for example Contributte\Codeception\Http\Request is used which does not have isFrom implemented

Possible Solution

add check with instanceof

[dg]

I understand this is a problem when someone uses a custom IRequest implementation, I didn't take that into account. But I can't simply skip the check: isFrom(FetchSite::SameOrigin) is a CSRF protection, so guarding it with instanceof and silently skipping it would disable this protection and effectively open a security hole.

How would you expect it to behave without compromising security? Treating such requests as cross-origin (fail closed) would reject your Codeception request too, just with a different error.

[janfejtek]

Yes, you are right. Then it would probably make sense to check using method_exists to make it backwards compatible? Check if isFrom exists, if not use isSameSite? But to me it still looks like there is a problem when nette/application shows dependency on interface, but in reality it neeeds actual implementation of Request class

[janfejtek]

Hello @dg what do you think? Should I sent PR?

[dg]

Sorry for the BC break, I didn't realize it would hit custom implementations. But adding these to IRequest isn't an option is v3.3, it'd break every existing implementation. And the isSameSite() fallback has the same flaw as isFrom(): both are only @method annotations, so a custom Request won't have either.

The cleanest fix is a PR to Contributte\Codeception adding both methods to its Request, could you send PR?