TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:24 +02:00
commit aad9daaefd
1506 changed files with 94005 additions and 0 deletions
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Form\Domain\Runtime\FormRuntime;
+
+use TYPO3\CMS\Core\Crypto\HashAlgo;
+use TYPO3\CMS\Core\Crypto\HashService;
+use TYPO3\CMS\Core\Crypto\Random;
+use TYPO3\CMS\Core\Error\Http\BadRequestException;
+use TYPO3\CMS\Core\Exception\Crypto\InvalidHashStringException;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Form\Security\HashScope;
+
+/**
+ * @internal
+ */
+class FormSession
+{
+    protected $identifier;
+
+    /**
+     * Factory to create the form session from the current state
+     *
+     * @param string|null $authenticatedIdentifier
+     * @throws BadRequestException
+     */
+    public function __construct(?string $authenticatedIdentifier = null)
+    {
+        if ($authenticatedIdentifier === null) {
+            $this->identifier = $this->generateIdentifier();
+        } else {
+            $this->identifier = $this->validateIdentifier($authenticatedIdentifier);
+        }
+    }
+
+    /**
+     * @internal
+     */
+    public function getIdentifier(): string
+    {
+        return $this->identifier;
+    }
+
+    /**
+     * Consumed by TYPO3\CMS\Form\ViewHelpers\FormViewHelper
+     *
+     * @internal
+     */
+    public function getAuthenticatedIdentifier(): string
+    {
+        return GeneralUtility::makeInstance(HashService::class)
+            // restrict string expansion by adding some char ('|')
+            ->appendHmac($this->identifier . '|', HashScope::FormSession->prefix(), HashAlgo::SHA3_256);
+    }
+
+    protected function generateIdentifier(): string
+    {
+        return GeneralUtility::makeInstance(Random::class)->generateRandomHexString(40);
+    }
+
+    /**
+     * @throws BadRequestException
+     */
+    protected function validateIdentifier(string $authenticatedIdentifier): string
+    {
+        try {
+            $identifier = GeneralUtility::makeInstance(HashService::class)
+                ->validateAndStripHmac($authenticatedIdentifier, HashScope::FormSession->prefix(), HashAlgo::SHA3_256);
+            return rtrim($identifier, '|');
+        } catch (InvalidHashStringException $e) {
+            throw new BadRequestException('The HMAC of the form session could not be validated.', 1613300274);
+        }
+    }
+}