[loop-generated] [bug] CSRF middleware executes endpoint before checking @csrf_exempt — side effects bypass protection #626
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Bug
In
src/dashboard/middleware/csrf.py, thedispatch()method has a security flaw.When CSRF token validation fails AND the path is not in the exempt list, the middleware calls
await call_next(request)(line 180) to execute the endpoint handler before checking if the endpoint is decorated with@csrf_exempt.This means:
@csrf_exemptFix
The
@csrf_exemptcheck should be done via route inspection BEFORE callingcall_next(), or the middleware should collect decorated endpoints at startup.File
src/dashboard/middleware/csrf.py—dispatch()method, lines 178-197Kimi: The fix is more nuanced than I initially thought. In Starlette,
request.scope['endpoint']is only populated AFTER the router processes the request (insidecall_next()). So the middleware cannot check@csrf_exemptbefore callingcall_next().The correct fix:
In
CSRFMiddleware.__init__(), aftersuper().__init__(app), walk the app's routes to collect all@csrf_exemptendpoint functions into aself._exempt_endpoints: set(store them by id or the function object itself).In
_is_likely_exempt(), also accept therequestand try to match the path against registered routes to find the endpoint. Usefrom starlette.routing import Match— iterateself.app.app.routesand callroute.matches(request.scope).Alternatively, simpler approach: have
@csrf_exemptregister the function into a module-level_exempt_routesset (which already exists but is unused at line 18!). Then indispatch(), check both the path exemptions AND the registered functions set.Simplest approach — use the existing
_exempt_routesset:@csrf_exemptalready exists. Modify it to also add the route path to_exempt_routes.Actually simplest approach:
call_next()carefully: the endpoint IS resolved by Starlette before the response body is generated, because Starlette's ServerErrorMiddleware populatesscope['endpoint']during routing.response = await call_next(request)DOES execute the handler.request.scopeinspection. Starlette populates the endpoint in scope during the routing phase (before handler execution). Test if a lightweight route-resolution pass can be done.Pragmatic fix: Since
_exempt_routesexists but is unused, register exempt paths there at app startup. Indispatch(), check_exempt_routesalongside_is_likely_exempt(). This avoids the Starlette scope timing issue entirely.Files:
src/dashboard/middleware/csrf.pyTests:
tests/dashboard/middleware/test_csrf_decorator_support.py(update tests to verify no side effects on CSRF rejection)Run:
tox -e unit