From 71c97a0d8962175090e4a18633cff362fdfa2791 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Halil=20=C4=B0brahim=20Kalkan?= <hi_kalkan@yahoo.com>
Date: Wed, 7 Oct 2020 15:27:46 +0300
Subject: [PATCH] Added antiforgery options

---
 .../AbpAntiForgeryCookieNameProvider.cs       |  5 ++++
 .../Mvc/AntiForgery/AbpAntiForgeryOptions.cs  | 29 +++++++++++++++++++
 ...dateAntiforgeryTokenAuthorizationFilter.cs | 24 +++++++++++----
 .../System/AbpObjectExtensions.cs             | 14 ++++++++-
 4 files changed, 66 insertions(+), 6 deletions(-)

diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
index fa51d168d6..66cd8701de 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
@@ -19,6 +19,11 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 
         public virtual string GetAuthCookieNameOrNull()
         {
+            if (_abpAntiForgeryOptions.AuthCookieSchemaName == null)
+            {
+                return null;
+            }
+
             return _namedOptionsAccessor.Get(_abpAntiForgeryOptions.AuthCookieSchemaName)?.Cookie?.Name;
         }
 
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
index f46763ab0c..44c35e9e0a 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using JetBrains.Annotations;
 using Microsoft.AspNetCore.Http;
 
 namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
@@ -23,8 +24,34 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
         /// </summary>
         public bool AutoValidate { get; set; } = true;
 
+        /// <summary>
+        /// A predicate to filter types to auto-validate.
+        /// Return true to select the type to validate.
+        /// Default: returns true for all given types.
+        /// </summary>
+        [NotNull]
+        public Predicate<Type> AutoValidateFilter
+        {
+            get => _autoValidateFilter;
+            set => _autoValidateFilter = Check.NotNull(value, nameof(value));
+        }
+        private Predicate<Type> _autoValidateFilter;
+
+        /// <summary>
+        /// Default methods: "GET", "HEAD", "TRACE", "OPTIONS".
+        /// </summary>
+        [NotNull]
+        public HashSet<string> AutoValidateIgnoredHttpMethods
+        {
+            get => _autoValidateIgnoredHttpMethods;
+            set => _autoValidateIgnoredHttpMethods = Check.NotNull(value, nameof(value));
+        }
+        private HashSet<string> _autoValidateIgnoredHttpMethods;
+
         public AbpAntiForgeryOptions()
         {
+            AutoValidateFilter = type => true;
+
             TokenCookie = new CookieBuilder
             {
                 Name = "XSRF-TOKEN",
@@ -34,6 +61,8 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
             };
 
             AuthCookieSchemaName = "Identity.Application";
+
+            AutoValidateIgnoredHttpMethods = new HashSet<string> {"GET", "HEAD", "TRACE", "OPTIONS"};
         }
     }
 }
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
index 40ed6fc509..8affb3aa08 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
@@ -1,5 +1,6 @@
 using System;
 using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -31,6 +32,19 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
                 return false;
             }
 
+            if(context.ActionDescriptor.IsControllerAction())
+            {
+                var controllerType = context.ActionDescriptor
+                    .AsControllerActionDescriptor()
+                    .ControllerTypeInfo
+                    .AsType();
+
+                if (!_options.AutoValidateFilter(controllerType))
+                {
+                    return false;
+                }
+            }
+
             if (IsIgnoredHttpMethod(context))
             {
                 return false;
@@ -41,11 +55,11 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 
         protected virtual bool IsIgnoredHttpMethod(AuthorizationFilterContext context)
         {
-            var method = context.HttpContext.Request.Method;
-            return string.Equals("GET", method, StringComparison.OrdinalIgnoreCase) ||
-                   string.Equals("HEAD", method, StringComparison.OrdinalIgnoreCase) ||
-                   string.Equals("TRACE", method, StringComparison.OrdinalIgnoreCase) ||
-                   string.Equals("OPTIONS", method, StringComparison.OrdinalIgnoreCase);
+            return context.HttpContext
+                .Request
+                .Method
+                .ToUpperInvariant()
+                .IsIn(_options.AutoValidateIgnoredHttpMethods);
         }
     }
 }
diff --git a/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs b/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
index d1067a383f..958398e0c5 100644
--- a/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
+++ b/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
@@ -1,4 +1,5 @@
-using System.ComponentModel;
+using System.Collections.Generic;
+using System.ComponentModel;
 using System.Globalization;
 using System.Linq;
 
@@ -49,6 +50,17 @@ namespace System
             return list.Contains(item);
         }
 
+        /// <summary>
+        /// Check if an item is in the given enumerable.
+        /// </summary>
+        /// <param name="item">Item to check</param>
+        /// <param name="items">Items</param>
+        /// <typeparam name="T">Type of the items</typeparam>
+        public static bool IsIn<T>(this T item, IEnumerable<T> items)
+        {
+            return items.Contains(item);
+        }
+
         /// <summary>
         /// Can be used to conditionally perform a function
         /// on an object and return the modified or the original object.