OXDEV-10199 Remove stoken from specific GET forms

Author: hkreuter

CHANGELOG.md

@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [4.0.0] - Unreleased
 
+### Added
+- Strip session token (stoken) from GET form URLs (search, attribute filter, product list) via new Form Security admin setting
+
 ### Changed
 - Updated to work with OXID eShop 7.5.x
 - Minimum PHP version is now 8.3, tested with up to PHP 8.5

metadata.php

@@ -10,6 +10,7 @@
  */
 
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Settings\TwoFAShopSettings as TwoFactorAuthModuleSettings;
+use OxidEsales\SecurityModule\FormSecurity\Service\ModuleSettingsService as FormSecurityModuleSettings;
 use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsService as PasswordPolicyModuleSettings;
 use OxidEsales\SecurityModule\Captcha\Service\ModuleSettingsService as CaptchaModuleSettings;
 use OxidEsales\SecurityModule\Core\Module;
@@ -113,6 +114,14 @@
             'value' => '15min'
         ],
 
+        //Form security
+        [
+            'group' => 'form_security',
+            'name'  => FormSecurityModuleSettings::GET_FORM_STRIP_STOKEN,
+            'type'  => 'bool',
+            'value' => false
+        ],
+
         //TwoFactorAuth settings
         [
             'group' => 'two_factor_auth',

services.yaml

@@ -1,5 +1,6 @@
 imports:
   - { resource: src/Captcha/services.yaml }
+  - { resource: src/FormSecurity/services.yaml }
   - { resource: src/PasswordPolicy/services.yaml }
   - { resource: src/Authentication/services.yaml }
 

src/FormSecurity/Service/ModuleSettingsService.php

@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\FormSecurity\Service;
+
+use OxidEsales\EshopCommunity\Internal\Framework\Module\Facade\ModuleSettingServiceInterface;
+use OxidEsales\SecurityModule\Core\Module;
+
+class ModuleSettingsService implements ModuleSettingsServiceInterface
+{
+    public const GET_FORM_STRIP_STOKEN = 'oeSecurityGetFormStripStoken';
+
+    public function __construct(
+        private readonly ModuleSettingServiceInterface $moduleSettingService,
+    ) {
+    }
+
+    public function isGetFormStripStokenEnabled(): bool
+    {
+        return $this->moduleSettingService->getBoolean(self::GET_FORM_STRIP_STOKEN, Module::MODULE_ID);
+    }
+}

src/FormSecurity/Service/ModuleSettingsServiceInterface.php

@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\FormSecurity\Service;
+
+interface ModuleSettingsServiceInterface
+{
+    public function isGetFormStripStokenEnabled(): bool;
+}

src/FormSecurity/services.yaml

@@ -0,0 +1,8 @@
+services:
+  _defaults:
+    public: false
+    autowire: true
+
+  OxidEsales\SecurityModule\FormSecurity\Service\ModuleSettingsServiceInterface:
+    class: OxidEsales\SecurityModule\FormSecurity\Service\ModuleSettingsService
+    public: true

src/Shared/Core/ViewConfig.php

@@ -12,6 +12,8 @@
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Settings\TwoFAShopSettingsInterface;
 use OxidEsales\SecurityModule\Captcha\Captcha\Image\Service\ImageCaptchaService;
 use OxidEsales\SecurityModule\Captcha\Service\CaptchaServiceInterface;
+// phpcs:ignore Generic.Files.LineLength
+use OxidEsales\SecurityModule\FormSecurity\Service\ModuleSettingsServiceInterface as FormSecuritySettingsServiceInterface;
 use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsServiceInterface as PasswordSettingsServiceInterface;
 use OxidEsales\SecurityModule\Captcha\Service\ModuleSettingsServiceInterface as CaptchaSettingsServiceInterface;
 use OxidEsales\Eshop\Core\Registry;
@@ -57,4 +59,27 @@ public function isTwoFAEnabledForShop(): bool
     {
         return $this->getService(TwoFAShopSettingsInterface::class)->isTwoFactorAuthEnabled();
     }
+
+    public function getSecurityModuleFormSettings(): FormSecuritySettingsServiceInterface
+    {
+        return $this->getService(FormSecuritySettingsServiceInterface::class);
+    }
+
+    public function getHiddenParamsOnly(): string
+    {
+        $value = '';
+
+        if (($lang = $this->getFormLang())) {
+            $value .= "\n{$lang}";
+        }
+
+        $value .= $this->getAdditionalRequestParameters();
+
+        return $value;
+    }
+
+    protected function getFormLang(): string
+    {
+        return Registry::getLang()->getFormLang();
+    }
 }

tests/Codeception/Acceptance/BaseCest.php

@@ -15,6 +15,7 @@
 use OxidEsales\SecurityModule\Authentication\TwoFactorAuth\Settings\TwoFAShopSettings;
 use OxidEsales\SecurityModule\Captcha\Service\ModuleSettingsService as CaptchaModuleSettingsService;
 use OxidEsales\SecurityModule\Core\Module;
+use OxidEsales\SecurityModule\FormSecurity\Service\ModuleSettingsService as FormSecurityModuleSettings;
 use OxidEsales\SecurityModule\Tests\Codeception\Support\AcceptanceTester;
 use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsServiceInterface as PasswordSettingsServiceInterface;
 
@@ -56,6 +57,15 @@ protected function setTwoFactorAuthState(bool $state)
         );
     }
 
+    protected function setGetFormStripStokenState(bool $state): void
+    {
+        ContainerFacade::get(ModuleSettingServiceInterface::class)->saveBoolean(
+            FormSecurityModuleSettings::GET_FORM_STRIP_STOKEN,
+            $state,
+            Module::MODULE_ID
+        );
+    }
+
     protected function setUserTwoFAState(AcceptanceTester $I, bool $state): void
     {
         $userData = $this->getExistingUserData();

tests/Codeception/Acceptance/GetFormSecurityCest.php

@@ -0,0 +1,120 @@
+<?php
+
+/**
+ * Copyright © OXID eSales AG. All rights reserved.
+ * See LICENSE file for license details.
+ */
+
+declare(strict_types=1);
+
+namespace OxidEsales\SecurityModule\Tests\Codeception\Acceptance;
+
+use OxidEsales\Codeception\Page\Account\UserLogin;
+use OxidEsales\SecurityModule\Tests\Codeception\Support\AcceptanceTester;
+
+/**
+ * @group oe_security_module
+ * @group oe_security_module_form_security
+ */
+class GetFormSecurityCest extends BaseCest
+{
+    private const SEARCH_TERM = '1000';
+    private const CATEGORY = 'Test category 0 [EN] šÄßüл';
+    private const ATTRIBUTE_NAME = 'Test attribute 1 [EN] šÄßüл';
+    private const ATTRIBUTE_VALUE = 'attr value 1 [EN] šÄßüл';
+
+    public function _before(AcceptanceTester $I): void
+    {
+        $this->setCaptchaState(false);
+        $this->setPasswordState(false);
+        $this->setGetFormStripStokenState(false);
+        $this->loginUser($I);
+    }
+
+    private function loginUser(AcceptanceTester $I): void
+    {
+        $userData = $this->getExistingUserData();
+        $loginPage = new UserLogin($I);
+        $I->amOnPage($loginPage->URL);
+        $loginPage->login($userData['userLoginName'], $userData['userPassword']);
+    }
+
+    public function _after(AcceptanceTester $I): void
+    {
+        $this->setGetFormStripStokenState(false);
+    }
+
+    public function testSearchFormFunctionsByDefault(AcceptanceTester $I): void
+    {
+        $I->wantToTest('search form works and includes stoken in URL when setting is disabled');
+
+        $I->openShop()
+            ->searchFor(self::SEARCH_TERM)
+            ->seeSearchCount(1);
+
+        $I->seeInCurrentUrl('stoken=');
+    }
+
+    public function testSearchFormStripsStokenWhenSettingIsEnabled(AcceptanceTester $I): void
+    {
+        $I->wantToTest('search form works and stoken is absent from URL when setting is enabled');
+
+        $this->setGetFormStripStokenState(true);
+
+        $I->openShop()
+            ->searchFor(self::SEARCH_TERM)
+            ->seeSearchCount(1);
+
+        $I->dontSeeInCurrentUrl('stoken=');
+    }
+
+    public function testAttributeFilterFunctionsByDefault(AcceptanceTester $I): void
+    {
+        $I->wantToTest('attribute filter works and includes stoken in URL when setting is disabled');
+
+        $I->openShop()
+            ->openCategoryPage(self::CATEGORY)
+            ->selectFilter(self::ATTRIBUTE_NAME, self::ATTRIBUTE_VALUE);
+
+        $I->seeInCurrentUrl('stoken=');
+    }
+
+    public function testAttributeFilterStripsStokenWhenSettingIsEnabled(AcceptanceTester $I): void
+    {
+        $I->wantToTest('attribute filter works and stoken is absent from URL when setting is enabled');
+
+        $this->setGetFormStripStokenState(true);
+
+        $I->openShop()
+            ->openCategoryPage(self::CATEGORY)
+            ->selectFilter(self::ATTRIBUTE_NAME, self::ATTRIBUTE_VALUE);
+
+        $I->dontSeeInCurrentUrl('stoken=');
+    }
+
+    public function testResetFilterFunctionsByDefault(AcceptanceTester $I): void
+    {
+        $I->wantToTest('reset filter works and includes stoken in URL when setting is disabled');
+
+        $I->openShop()
+            ->openCategoryPage(self::CATEGORY)
+            ->selectFilter(self::ATTRIBUTE_NAME, self::ATTRIBUTE_VALUE)
+            ->resetFilter();
+
+        $I->seeInCurrentUrl('stoken=');
+    }
+
+    public function testResetFilterStripsStokenWhenSettingIsEnabled(AcceptanceTester $I): void
+    {
+        $I->wantToTest('reset filter works and stoken is absent from URL when setting is enabled');
+
+        $this->setGetFormStripStokenState(true);
+
+        $I->openShop()
+            ->openCategoryPage(self::CATEGORY)
+            ->selectFilter(self::ATTRIBUTE_NAME, self::ATTRIBUTE_VALUE)
+            ->resetFilter();
+
+        $I->dontSeeInCurrentUrl('stoken=');
+    }
+}

tests/Codeception/Support/Data/fixtures.sql

@@ -7,3 +7,25 @@ REPLACE INTO `oxarticles` (`OXID`, `OXSHOPID`, `OXPARENTID`, `OXACTIVE`, `OXARTN
 VALUES ('1000', 1, '', 1, '1000', '[DE 4] Test product 0 šÄßüл', 'Test product 0 short desc [DE]', 50, 35, 45, 55, 0, 'kg', 2, NULL, 2, 15, 1, 'In stock [DE]', 'Out of stock [DE]', '0000-00-00', '2008-02-04', '2008-02-04 17:07:48', 1, 2, 2, 'search1000', 1, '', 0, 0, '', 50, 0, '', '', 'Test product 0 [EN] šÄßüл', 'Test product 0 short desc [EN] šÄßüл', 'šÄßüл1000', '', 'In stock [EN] šÄßüл', 'Out of stock [EN] šÄßüл', 0, 'testdistributor', 'testmanufacturer', 1, 1, 'DAY');
 
 UPDATE `oxcountry` SET `OXACTIVE` = 1 , `OXID` = 'testcountry_de' WHERE `OXISOALPHA2` = 'DE';
+
+-- Form Security test data for GetFormSecurityCest
+
+REPLACE INTO `oxarticles` (`OXID`, `OXSHOPID`, `OXPARENTID`, `OXACTIVE`, `OXARTNUM`, `OXTITLE`, `OXSHORTDESC`, `OXPRICE`, `OXPRICEA`, `OXPRICEB`, `OXPRICEC`, `OXTPRICE`, `OXUNITNAME`, `OXUNITQUANTITY`, `OXVAT`, `OXWEIGHT`, `OXSTOCK`, `OXSTOCKFLAG`, `OXSTOCKTEXT`, `OXNOSTOCKTEXT`, `OXDELIVERY`, `OXINSERT`, `OXTIMESTAMP`, `OXLENGTH`, `OXWIDTH`, `OXHEIGHT`, `OXSEARCHKEYS`, `OXISSEARCH`, `OXVARNAME`, `OXVARSTOCK`, `OXVARCOUNT`, `OXVARSELECT`, `OXVARMINPRICE`, `OXVARMAXPRICE`, `OXVARNAME_1`, `OXVARSELECT_1`, `OXTITLE_1`, `OXSHORTDESC_1`, `OXSEARCHKEYS_1`, `OXBUNDLEID`, `OXSTOCKTEXT_1`, `OXNOSTOCKTEXT_1`, `OXSORT`, `OXVENDORID`, `OXMANUFACTURERID`, `OXMINDELTIME`, `OXMAXDELTIME`, `OXDELTIMEUNIT`)
+VALUES ('1001', 1, '', 1, '1001', '[DE] Test product 1 šÄßüл', 'Test product 1 short desc [DE]', 100, 70, 90, 110, 0, 'kg', 1, NULL, 1, 10, 1, 'In stock [DE]', 'Out of stock [DE]', '0000-00-00', '2008-02-04', '2008-02-04 17:07:48', 1, 1, 1, 'search1001', 1, '', 0, 0, '', 100, 0, '', '', 'Test product 1 [EN] šÄßüл', 'Test product 1 short desc [EN] šÄßüл', 'šÄßüл1001', '', 'In stock [EN] šÄßüл', 'Out of stock [EN] šÄßüл', 0, 'testdistributor', 'testmanufacturer', 1, 1, 'DAY');
+
+REPLACE INTO `oxcategories` (`OXID`, `OXPARENTID`, `OXLEFT`, `OXRIGHT`, `OXROOTID`, `OXSORT`, `OXACTIVE`, `OXACTIVE_1`, `OXHIDDEN`, `OXSHOPID`, `OXTITLE`, `OXTITLE_1`, `OXDESC`, `OXDESC_1`, `OXLONGDESC`, `OXLONGDESC_1`)
+VALUES ('oesm_testcat', 'oxrootid', 1, 2, 'oesm_testcat', 0, 1, 1, 0, 1, '[DE] Test Kategorie 0 šÄßüл', 'Test category 0 [EN] šÄßüл', '', '', '', '');
+
+REPLACE INTO `oxattribute` (`OXID`, `OXSHOPID`, `OXTITLE`, `OXTITLE_1`, `OXPOS`)
+VALUES ('oesm_testattr1', 1, '[DE] Test Attribut 1 šÄßüл', 'Test attribute 1 [EN] šÄßüл', 1);
+
+REPLACE INTO `oxcategory2attribute` (`OXID`, `OXOBJECTID`, `OXATTRID`, `OXSORT`)
+VALUES ('oesm_cat2attr1', 'oesm_testcat', 'oesm_testattr1', 1);
+
+REPLACE INTO `oxobject2category` (`OXID`, `OXOBJECTID`, `OXCATNID`, `OXPOS`, `OXTIME`)
+VALUES ('oesm_p1000incat', '1000', 'oesm_testcat', 0, 0),
+       ('oesm_p1001incat', '1001', 'oesm_testcat', 0, 0);
+
+-- Product 1000 has attribute value → survives filter; product 1001 has no value → filtered out
+REPLACE INTO `oxobject2attribute` (`OXID`, `OXOBJECTID`, `OXATTRID`, `OXVALUE`, `OXVALUE_1`, `OXPOS`)
+VALUES ('oesm_1000attr1', '1000', 'oesm_testattr1', '[DE] Attributwert 1 šÄßüл', 'attr value 1 [EN] šÄßüл', 1);