You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:13:17 UTC
[I] Make CSRF token required in Form base class (tooling-trusted-releases)
andrewmusselman opened a new issue, #792:
URL: https://github.com/apache/tooling-trusted-releases/issues/792
**ASVS:** 3.5.1 · **CWE:** CWE-352 · **File:** `atr/models/schema.py`
### Description
The `Form` base class defines the CSRF token field as optional:
```python
class Form(pydantic.BaseModel):
csrf_token: str | None = None # Optional
```
While the global CSRF middleware validates tokens regardless of the model definition, making the field optional weakens the validation contract and could mask issues if the middleware is ever bypassed or misconfigured.
### Recommended fix
```python
class Form(pydantic.BaseModel):
csrf_token: str # Required
```
Test whether `csrf: str` works
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Make CSRF token required in Form base class (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #792: Make CSRF token required in Form base class
URL: https://github.com/apache/tooling-trusted-releases/issues/792
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Make CSRF token required in Form base class (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #792:
URL: https://github.com/apache/tooling-trusted-releases/issues/792#issuecomment-4040928404
Resolved by 645aefb074e157de68961d0cd282144f90799df7.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org