<commit_before>// modified csrf middleware to better handle regenerating sessions during request handling, and
// setting/getting Angular's XSRF cookie/header
var uid = require('uid2')
  , http = require('http')

module.exports = function csrf(options) {
  options = options || {}
  var value = options.value || defaultValue
    , setter = options.setter || defaultSetter

  return function doCsrf(req, res, next) {
    res.on('header', function() {
      setter(req, res, getToken(req))
    })

    var token = getToken(req) // need to do this here to ensure every request has a token set
    if (req.method == 'GET' || req.method == 'HEAD' || req.method == 'OPTIONS') return next()

    var val = value(req)
    if (val != token) {
      res.statusCode = 403
      res.end(http.STATUS_CODES[403])
      return
    }

    next()
  }

  function getToken(req) {
    if (!req.session._csrf) {
      req.session._csrf = uid(24)
    }
    return req.session._csrf
  }

  function defaultValue(req) {
    return (
        (req.headers['x-xsrf-token']) ||
        (req.body && req.body._csrf) ||
        (req.query && req.query._csrf)
    )
  }

  function defaultSetter(req, res, token) {
    // only send the cookie if they don't already have it
    if (req.cookies['XSRF-TOKEN'] != token) res.cookie('XSRF-TOKEN', token)
  }
}<commit_msg>Fix late CSRF token generation.<commit_after>// modified csrf middleware to better handle regenerating sessions during request handling, and
// setting/getting Angular's XSRF cookie/header
var uid = require('uid2')
  , http = require('http')

module.exports = function csrf(options) {
  options = options || {}
  var value = options.value || defaultValue
    , setter = options.setter || defaultSetter

  return function doCsrf(req, res, next) {
    res.on('header', function() {
      setter(req, res, getToken(req, true))
    })

    var token = getToken(req, false) // need to do this here to ensure every request has a token set
    if (req.method == 'GET' || req.method == 'HEAD' || req.method == 'OPTIONS') return next()

    var val = value(req)
    if (val != token) {
      res.statusCode = 403
      res.end(http.STATUS_CODES[403])
      return
    }

    next()
  }

  function getToken(req, needsSave) {
    if (!req.session._csrf) {
      req.session._csrf = uid(24)
      // if the csrf gets regenerated while sending headers, it won't be automatically saved by
      // the session middleware, so we need to manually trigger the save
      if (needsSave) {
        req.session.save(function(err) {
          if (err) req.log.error({ err: err }, 'error saving session')
        })
      }
    }
    return req.session._csrf
  }

  function defaultValue(req) {
    return (
        (req.headers['x-xsrf-token']) ||
        (req.body && req.body._csrf) ||
        (req.query && req.query._csrf)
    )
  }

  function defaultSetter(req, res, token) {
    // only send the cookie if they don't already have it
    if (req.cookies['XSRF-TOKEN'] != token) res.cookie('XSRF-TOKEN', token)
  }
}
{'fraction_non_alphanumeric': 0.13533091866973987, 'fraction_numerical': 0.005926901547579849, 'mean_word_length': 2.75990099009901, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3544575', 'n_tokens_mistral': 993, 'n_tokens_neox': 960, 'n_words': 273}