<commit_before>package jantar

import (
	"crypto/rand"
	"encoding/hex"
	"github.com/tsurai/jantar/context"
	"html/template"
	"net/http"
	"strings"
)

// TODO: accept custom handler

// csrf is a Middleware that protects against cross-side request forgery
type csrf struct {
	Middleware
}

// Initialize prepares csrf for usage
// Note: Do not call this yourself
func (c *csrf) Initialize() {
	// add all hooks to TemplateManger
	tm := GetModule(ModuleTemplateManager).(*TemplateManager)
	if tm == nil {
		Log.Fatal("failed to get template manager")
	}

	tm.AddTmplFunc("csrfToken", func() string { return "" })

	tm.AddHook(TmBeforeParse, beforeParseHook)
	tm.AddHook(TmBeforeRender, beforeRenderHook)
}

// Cleanup saves the current secretkey to accept old tokens with the next start
func (c *csrf) Cleanup() {
	// TODO: Save last secretkey for the next start
}

// Call executes the Middleware
// Note: Do not call this yourself
func (c *csrf) Call(respw http.ResponseWriter, req *http.Request) bool {
	var cookieToken string

	if cookie, err := req.Cookie("JANTAR_ID"); err == nil {
		cookieToken = hex.EncodeToString([]byte(cookie.Value))
	} else {
		cookieTokenBuffer := make([]byte, 32)
		if n, err := rand.Read(cookieTokenBuffer); n != 32 || err != nil {
			Log.Fatal("failed to generate secret key")
		}

		cookieToken = hex.EncodeToString(cookieTokenBuffer)
		http.SetCookie(respw, &http.Cookie{Name: "JANTAR_ID", Value: cookieToken})
	}

	context.Set(req, "_csrf", cookieToken, true)

	// check for safe methods
	if req.Method == "GET" || req.Method == "HEAD" {<commit_msg>made csrf cookie http only<commit_after>package jantar

import (
	"crypto/rand"
	"encoding/hex"
	"github.com/tsurai/jantar/context"
	"html/template"
	"net/http"
	"strings"
)

// TODO: accept custom handler

// csrf is a Middleware that protects against cross-side request forgery
type csrf struct {
	Middleware
}

// Initialize prepares csrf for usage
// Note: Do not call this yourself
func (c *csrf) Initialize() {
	// add all hooks to TemplateManger
	tm := GetModule(ModuleTemplateManager).(*TemplateManager)
	if tm == nil {
		Log.Fatal("failed to get template manager")
	}

	tm.AddTmplFunc("csrfToken", func() string { return "" })

	tm.AddHook(TmBeforeParse, beforeParseHook)
	tm.AddHook(TmBeforeRender, beforeRenderHook)
}

// Cleanup saves the current secretkey to accept old tokens with the next start
func (c *csrf) Cleanup() {
	// TODO: Save last secretkey for the next start
}

// Call executes the Middleware
// Note: Do not call this yourself
func (c *csrf) Call(respw http.ResponseWriter, req *http.Request) bool {
	var cookieToken string

	if cookie, err := req.Cookie("JANTAR_ID"); err == nil {
		cookieToken = hex.EncodeToString([]byte(cookie.Value))
	} else {
		cookieTokenBuffer := make([]byte, 32)
		if n, err := rand.Read(cookieTokenBuffer); n != 32 || err != nil {
			Log.Fatal("failed to generate secret key")
		}

		cookieToken = hex.EncodeToString(cookieTokenBuffer)
		http.SetCookie(respw, &http.Cookie{Name: "JANTAR_ID", Value: cookieToken, HttpOnly: true, Path: "/"})
	}

	context.Set(req, "_csrf", cookieToken, true)

	// check for safe methods
	if req.Method == "GET" || req.Method == "HEAD" {
{'fraction_non_alphanumeric': 0.12819713038053648, 'fraction_numerical': 0.002495321272613849, 'mean_word_length': 4.292079207920792, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2412237', 'n_tokens_mistral': 1086, 'n_tokens_neox': 1041, 'n_words': 319}