SameOrigin validation fails with custom Nette\Http\IRequest implementation

[janfejtek]

Version: 3.3.0

Bug Description

Form validation for received signal $presenter->getHttpRequest()->isFrom(Nette\Http\FetchSite::SameOrigin) fails if custom Request class is used. Calling isFrom is not possible on IRequest interface as it does not exist

application/src/Application/UI/Form.php

Lines 144 to 146 in b670493

	} elseif (!$this->crossOrigin && !$presenter->getHttpRequest()->isFrom(Nette\Http\FetchSite::SameOrigin)) {
	$presenter->detectedCsrf();

Steps To Reproduce

For example PHPStan or just add custom class implementing https://github.com/nette/http/blob/master/src/Http/IRequest.php

Expected Behavior

Do not throw exception when for example Contributte\Codeception\Http\Request is used which does not have isFrom implemented

Possible Solution

add check with instanceof

[dg]

I understand this is a problem when someone uses a custom IRequest implementation, I didn't take that into account. But I can't simply skip the check: isFrom(FetchSite::SameOrigin) is a CSRF protection, so guarding it with instanceof and silently skipping it would disable this protection and effectively open a security hole.

How would you expect it to behave without compromising security? Treating such requests as cross-origin (fail closed) would reject your Codeception request too, just with a different error.

[janfejtek]

Yes, you are right. Then it would probably make sense to check using method_exists to make it backwards compatible? Check if isFrom exists, if not use isSameSite? But to me it still looks like there is a problem when nette/application shows dependency on interface, but in reality it neeeds actual implementation of Request class

[janfejtek]

Hello @dg what do you think? Should I sent PR?