November 2013 - Zope-Dev

(optional) CSRF protection in zope.formlib
by Jan-Wijbrand Kolman 21 Nov '13

21 Nov '13

Hi, I've been working on CSRF protection for zope.formlib. I have a "csrfprotection" branch in my zope.formlib fork on github. The changes against the current zope.formlib mainline can be found here: https://github.com/janwijbrand/zope.formlib/compare/csrfprotection When creating form components based on zope.formlib.form.FormBase, one can enable this protection just by setting the attribute ``protected`` to True on the component. This implementation is based on the following assumptions: * We do not want to keep server-side state(!) * An "attacker" that attempts CSRF cannot get to information stored in cookies that are meant for the domain of the (forged) request. * The token stored in the cookie is sufficiently random and long, to be practically "unguessable" by the attacker. * The form submit is deemed valid as long as the token in the cookie is identical to a hidden input value that is part of the form submit. My questions: * Do you find this feature useful enough to be, in principle, included in zope.formlib? * I'd like to kindly request someone to review my branch and provide feedback. The included test cases describe a few more questions and concerns about this implementation. Thank you in advance! kind regards, jw

3 8

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 21 Nov '13

21 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-19 00:00:00 UTC and 2013-11-20 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 465 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 465 https://mail.zope.org/pipermail/zope-tests/2013-November/079749.html

1 0

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 20 Nov '13

20 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-18 00:00:00 UTC and 2013-11-19 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 464 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 464 https://mail.zope.org/pipermail/zope-tests/2013-November/079736.html

1 0

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 19 Nov '13

19 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-17 00:00:00 UTC and 2013-11-18 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 463 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 463 https://mail.zope.org/pipermail/zope-tests/2013-November/079723.html

1 0

zope-tests - FAILED: 3, OK: 12
by Zope tests summarizer 18 Nov '13

18 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-16 00:00:00 UTC and 2013-11-17 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 462 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [2] winbot / zc.queue_py_265_32 [3] winbot / zope.structuredtext_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 462 https://mail.zope.org/pipermail/zope-tests/2013-November/079710.html [2] FAILED winbot / zc.queue_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-November/079709.html [3] FAILED winbot / zope.structuredtext_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-November/079708.html

2 1

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 17 Nov '13

17 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-15 00:00:00 UTC and 2013-11-16 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 461 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 461 https://mail.zope.org/pipermail/zope-tests/2013-November/079695.html

1 0

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 16 Nov '13

16 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-14 00:00:00 UTC and 2013-11-15 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 460 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 460 https://mail.zope.org/pipermail/zope-tests/2013-November/079682.html

1 0

zope-tests - FAILED: 7, OK: 6
by Zope tests summarizer 15 Nov '13

15 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-13 00:00:00 UTC and 2013-11-14 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 459 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 [2] winbot / ztk_10 py_265_win64 [3] winbot / ztk_11 py_254_win32 [4] winbot / ztk_11 py_265_win32 [5] winbot / ztk_11 py_265_win64 [6] winbot / ztk_11 py_270_win32 [7] winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 459 https://mail.zope.org/pipermail/zope-tests/2013-November/079669.html [2] FAILED winbot / ztk_10 py_265_win64 https://mail.zope.org/pipermail/zope-tests/2013-November/079672.html [3] FAILED winbot / ztk_11 py_254_win32 https://mail.zope.org/pipermail/zope-tests/2013-November/079673.html [4] FAILED winbot / ztk_11 py_265_win32 https://mail.zope.org/pipermail/zope-tests/2013-November/079674.html [5] FAILED winbot / ztk_11 py_265_win64 https://mail.zope.org/pipermail/zope-tests/2013-November/079675.html [6] FAILED winbot / ztk_11 py_270_win32 https://mail.zope.org/pipermail/zope-tests/2013-November/079676.html [7] FAILED winbot / ztk_11 py_270_win64 https://mail.zope.org/pipermail/zope-tests/2013-November/079677.html

3 2

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 14 Nov '13

14 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-12 00:00:00 UTC and 2013-11-13 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 458 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 458 https://mail.zope.org/pipermail/zope-tests/2013-November/079656.html

1 0

zope-tests - FAILED: 1, OK: 12
by Zope tests summarizer 13 Nov '13

13 Nov '13

This is the summary for test reports received on the zope-tests list between 2013-11-11 00:00:00 UTC and 2013-11-12 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- [1] Still Failing - zopetoolkit_trunk - Build # 457 winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Still Failing - zopetoolkit_trunk - Build # 457 https://mail.zope.org/pipermail/zope-tests/2013-November/079643.html

1 0