feat: minify and transpile the JS code #31

OWASP · Oct 16, 2024 · c47c2a0 · c47c2a0
1 parent 4b36e80
commit c47c2a0
Show file tree

Hide file tree

Showing 13 changed files with 4,086 additions and 12 deletions.
diff --git a/csrfguard-test/csrfguard-test-jsp/pom.xml b/csrfguard-test/csrfguard-test-jsp/pom.xml
@@ -50,7 +50,7 @@
 
     <profiles>
         <profile>
-            <id>deploy-jsp-webapp</id>
+            <id>run-jsp-webapp</id>
             <properties>
                 <skip.run.webapp>false</skip.run.webapp>
             </properties>

diff --git a/csrfguard-test/csrfguard-test-jsp/src/main/webapp/WEB-INF/classes/Owasp.CsrfGuard.properties b/csrfguard-test/csrfguard-test-jsp/src/main/webapp/WEB-INF/classes/Owasp.CsrfGuard.properties
@@ -332,7 +332,7 @@ org.owasp.csrfguard.Config.Print = true
 
 # This property denotes the location of the JavaScript template file that should be consumed and dynamically
 # augmented by the JavaScriptServlet class.
-# If it's left blank, and it's not configured in the web.xml either, it defaults to META-INF/csrfguard.js.
+# If it's left blank, and it's not configured in the web.xml either, it defaults to META-INF/csrfguard.min.js.
 # Use of this property and the existence of the specified template file is required.
 org.owasp.csrfguard.JavascriptServlet.sourceFile =
 

diff --git a/csrfguard/pom.xml b/csrfguard/pom.xml
@@ -41,6 +41,59 @@
 	<name>OWASP CSRFGuard</name>
 	<description>OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.</description>
 
+	<profiles>
+		<profile>
+			<id>minify-js</id>
+			<activation>
+				<activeByDefault>false</activeByDefault>
+			</activation>
+			<properties>
+				<skip.minify-js>false</skip.minify-js>
+			</properties>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.codehaus.mojo</groupId>
+						<artifactId>exec-maven-plugin</artifactId>
+						<configuration>
+							<workingDirectory>${project.basedir}/src/main/resources</workingDirectory>
+						</configuration>
+						<executions>
+							<execution>
+								<id>npm-install</id>
+								<phase>generate-resources</phase>
+								<goals>
+									<goal>exec</goal>
+								</goals>
+								<configuration>
+									<executable>npm</executable>
+									<arguments>
+										<argument>install</argument>
+									</arguments>
+									<skip>${skip.minify-js}</skip>
+								</configuration>
+							</execution>
+							<execution>
+								<id>run-webpack</id>
+								<phase>compile</phase>
+								<goals>
+									<goal>exec</goal>
+								</goals>
+								<configuration>
+									<executable>npx</executable>
+									<arguments>
+										<argument>webpack</argument>
+									</arguments>
+									<skip>${skip.minify-js}</skip>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+	</profiles>
+
 	<dependencies>
 		<dependency>
 			<groupId>javax.servlet</groupId>
@@ -96,13 +149,28 @@
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
 			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-clean-plugin</artifactId>
+				<configuration>
+					<filesets>
+						<fileset>
+							<directory>src/main/resources</directory>
+							<includes>
+								<include>node_modules/**</include>
+							</includes>
+						</fileset>
+					</filesets>
+				</configuration>
+			</plugin>
 		</plugins>
 		<resources>
 			<resource>
 				<directory>src/main/resources</directory>
 				<filtering>true</filtering>
 				<includes>
 					<include>csrfguard.js</include>
+					<include>csrfguard.min.js</include>
 					<include>csrfguard.tld</include>
 					<include>license.txt</include>
 					<include>csrfguard.properties</include>

diff --git a/csrfguard/src/main/java/org/owasp/csrfguard/config/PropertiesConfigurationProvider.java b/csrfguard/src/main/java/org/owasp/csrfguard/config/PropertiesConfigurationProvider.java
@@ -573,7 +573,7 @@ private static String retrieveJavaScriptTemplateCode(ServletConfig servletConfig
 		String result = null;
 
 		if (StringUtils.isBlank(jsSourceFileLocation)) {
-			result = CsrfGuardUtils.readResourceFileContent("META-INF/csrfguard.js");
+			result = CsrfGuardUtils.readResourceFileContent("META-INF/csrfguard.min.js");
 		} else if (jsSourceFileLocation.startsWith("META-INF/")) {
 			result = CsrfGuardUtils.readResourceFileContent(jsSourceFileLocation);
 		} else if (jsSourceFileLocation.startsWith("classpath:")) {

diff --git a/csrfguard/src/main/resources/.babelrc b/csrfguard/src/main/resources/.babelrc
@@ -0,0 +1,14 @@
+{
+  "presets": [
+    [
+      "@babel/preset-env",
+      {
+        "targets": {
+          "esmodules": false,
+          "browsers": ["> 0.25%", "not dead"]
+        }
+      }
+    ]
+  ],
+  "plugins": ["transform-remove-console"]
+}
diff --git a/csrfguard/src/main/resources/.gitignore b/csrfguard/src/main/resources/.gitignore
@@ -0,0 +1 @@
+node_modules/**
diff --git a/csrfguard/src/main/resources/csrfguard.js b/csrfguard/src/main/resources/csrfguard.js
@@ -379,12 +379,12 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
                     hidden.setAttribute('value', value);
 
                     form.appendChild(hidden);
-                    //console.debug('Hidden input element [', hidden, '] was added to the form: ', form);
+                    console.debug('Hidden input element [', hidden, '] was added to the form: ', form);
                 } else {
                     hiddenTokenFields.forEach(function (i) {
                         return form.elements[i].value = value;
                     });
-                    //console.debug('Hidden token fields [', hiddenTokenFields, '] of form [', form, '] were updated with new token value: ', value);
+                    console.debug('Hidden token fields [', hiddenTokenFields, '] of form [', form, '] were updated with new token value: ', value);
                 }
             }
         }
@@ -429,7 +429,7 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
 
                     try {
                         element.setAttribute(attr, newLocation);
-                        //console.debug('Attribute [', attr, '] with value [', newLocation, '] set for element: ', element);
+                        console.debug('Attribute [', attr, '] with value [', newLocation, '] set for element: ', element);
                     } catch (e) {
                         // attempted to set/update unsupported attribute
                     }
@@ -440,7 +440,7 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
                     });
 
                     element.setAttribute(attr, newLocation);
-                    //console.debug('Attribute [', attr, '] with value [', newLocation, '] set for element: ', element);
+                    console.debug('Attribute [', attr, '] with value [', newLocation, '] set for element: ', element);
                 }
             }
         }
@@ -550,7 +550,7 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
                 if (xhr.readyState === 4) {
                     if (xhr.status === 200) {
                         let pageTokens = JSON.parse(xhr.responseText)['pageTokens'];
-                        //console.debug('Received page tokens: ', pageTokens);
+                        console.debug('Received page tokens: ', pageTokens);
                         callback.call(this, pageTokens);
                     } else {
                         alert(xhr.status + ': CSRF check failed');
@@ -604,7 +604,7 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
         if (isValidDomain(document.domain, target)) {
             var tokenName = '%TOKEN_NAME%';
             var masterTokenValue = '%TOKEN_VALUE%';
-            //console.debug('Master token [' + tokenName + ']: ', masterTokenValue);
+            console.debug('Master token [' + tokenName + ']: ', masterTokenValue);
 
             var isLoadedWrapper = {isDomContentLoaded: false};
 
@@ -643,15 +643,15 @@ if (owaspCSRFGuardScriptHasLoaded !== true) {
                                     let newMasterToken = tokenTO['masterToken'];
                                     if (newMasterToken !== undefined) {
                                         masterTokenValue = newMasterToken;
-                                        //console.debug('New master token value received: ', masterTokenValue);
+                                        console.debug('New master token value received: ', masterTokenValue);
                                     }
 
                                     let newPageTokens = tokenTO['pageTokens'];
                                     if (newPageTokens !== undefined) {
                                         Object.keys(newPageTokens).forEach(function (key) {
                                             return pageTokenWrapper.pageTokens[key] = newPageTokens[key];
                                         });
-                                        //console.debug('New page token value(s) received: ', newPageTokens);
+                                        console.debug('New page token value(s) received: ', newPageTokens);
                                     }
 
                                     injectTokens(tokenName, masterTokenValue, pageTokenWrapper.pageTokens);

diff --git a/csrfguard/src/main/resources/csrfguard.min.js b/csrfguard/src/main/resources/csrfguard.min.js
diff --git a/csrfguard/src/main/resources/csrfguard.properties b/csrfguard/src/main/resources/csrfguard.properties
@@ -332,7 +332,7 @@ org.owasp.csrfguard.Config.Print = true
 
 # This property denotes the location of the JavaScript template file that should be consumed and dynamically
 # augmented by the JavaScriptServlet class.
-# If it's left blank, and it's not configured in the web.xml either, it defaults to META-INF/csrfguard.js.
+# If it's left blank, and it's not configured in the web.xml either, it defaults to META-INF/csrfguard.min.js.
 # Use of this property and the existence of the specified template file is required.
 org.owasp.csrfguard.JavascriptServlet.sourceFile =