CSRF protection is disabled application-wide; link-creation form has no CSRF token #9
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Symfony's built-in CSRF protection is commented out in
config/packages/framework.yaml. The link-creation form (POST /link) contains no CSRF token.Location
config/packages/framework.yaml, line 4:#csrf_protection: truetemplates/index.html.twig, line 13 — form element with no CSRF token fieldRisk
Any third-party website can embed a hidden
<form>targeting the/linkendpoint and auto-submit it when a victim visits, triggering link creation from the victim's browser. With the service being public and unauthenticated the primary impact is abuse (automated junk-link generation through victim browsers). More critically, if authentication is added to the application in the future without re-enabling CSRF, the gap becomes an account-level vulnerability.Suggested fix direction
Uncomment
csrf_protection: trueinframework.yamland add a CSRF token to the form using Twig's{{ csrf_token('link') }}; validate it in the controller with$this->isCsrfTokenValid('link', $request->get('_token')).Severity
minor
Found by
Automated audit by Claude Code