derhansen / form_crshield Goto Github PK

View Code? Open in Web Editor NEW

12.0 4.0 7.0 233 KB

Challenge/response spam shield for TYPO3 form extension

License: GNU General Public License v2.0

PHP 90.06% JavaScript 3.56% Shell 6.38%

form spam-detection typo3-extension

form_crshield's Introduction

Form challenge/response spam shield

What is it?

Form challenge/response spambot shield is a TYPO3 extension to prevent automated form submissions in TYPO3 form extension.

How does it work?

Form challenge/response spam shield adds a hidden input field to every form generated by the TYPO3 form extension. The input field contains a data-attribute with a challenge. The included JavaScript will use the challenge to calculate an expected response which will be checked on every form submission. If the expected response is not submitted, validation for the hidden input field is considered as failed and no email will be sent.

In order to make automatic form submissions harder for spambots with active JavaScript, a configurable delay for the JavaScript response calculation can be defined in the extension settings (default value: 3 seconds).

Can the protection be bypassed?

Yes, the challenge/response spam shield can be bypassed, if the algorithm used by the extension is implemented to a spambot. This is however unlikely, since the spambot either has to use JavaScript (which I believe most spambots do not) or has to extract the challenge from the parsed HTML and must calculate and submit the response correctly.

Requirements

The extension uses JavaScript to calculate the expected response, so if JavaScript is disabled on client side, form submission will not be possible.

A modern webbrowser is required to run the JavaScript. Internet Explorer < 11 is not supported.

Installation

Just install the extension on your TYPO3 website using composer or the TYPO3 extension manager. No further configuration is required.

Extension settings

The extension has the following extension settings, which can be adjusted if required. The default values should however be fine for most websites.

crJavaScriptDelay

Defines the delay in seconds for the JavaScript response calculation. The default value is 3 seconds.

minimumPageExpirationTime

If the calculated page cache lifetime if very low (e.g. 60 seconds), it may not be possible to fill out a form before the expiration time for the CR response is reached. This setting defines the minimum amount of second, the calculated page cache lifetime must have. Default value is 900 seconds.

additionalPageExpirationTime

Defines the amount of seconds, which is added to the calculated page cache lifetime, if the calculated page cache lifetime is below the defined value in minimumPageExpirationTime.

Logging

In order to log failed requests, it is possible to use a dedicated logfile like shown below:

$GLOBALS['TYPO3_CONF_VARS']['LOG']['Derhansen']['FormCrshield']['Hooks']['Form']['writerConfiguration'] = [
    \TYPO3\CMS\Core\Log\LogLevel::DEBUG => [
        \TYPO3\CMS\Core\Log\Writer\FileWriter::class => [
            'logFile' => \TYPO3\CMS\Core\Core\Environment::getVarPath() . '/log/form-crshield.log',
        ]
    ]
];

Versions

Version	TYPO3	PHP	Support/Development
2.x	13.x	8.2 - 8.4	Features, Bugfixes, Security Updates
1.x	10.4 - 12.4	7.2 - 8.3	Features, Bugfixes, Security Updates

Thanks for sponsoring

Thanks to 3m5. Media GmbH for supporting my open source work on this extension

form_crshield's People

Contributors

Stargazers

Watchers

Forkers

infabo toujou zeroseven xerc kaystrobach maxmishyn ecogabe

form_crshield's Issues

[TASK] Avoid usage of EXEC_TIME

https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/GlobalVariables.html#confval-EXEC_TIME

Spam prevention doesn’t work anymore since update 1.4.0 -> 1.4.1

Hello, after updating form_crshield from 1.4.0 to 1.4.1 spam messages are not blocked anymore. Downgrading helped.
TYPO3 11.5.35
PHP 8.2

Message “detected as spam”

Hi,
I feedback message “Your message was detected as spam” would be good instead of just displaying the form again when the form was submitted and detected as spam.

Form does not get sent with version 1.4.0

The affected installation is using TYPO3 10.4.37 with PHP 7.4 and helhum/typo3-secure-web 0.3.2.

We have an contact email form there that is using EXT:form and this extension.

With version 1.3.2, I can submit the form (and get the email sent) without problems, and I see the thank-you page of the form.

With version 1.4.0, after submitting, the form gets displayed again (with the data I entered), no email is sent, and this gets logged in the TYPO3 debug log:

Thu, 01 Feb 2024 13:08:54 +0100 [DEBUG] request="19c4ec7b1b692" component="Derhansen.FormCrshield.Hooks.Form": Submitted data - {"text-1":"Oliver Klee","DZ7Fyhu1ivOeLGbaW3nXrmq":"","text-2":"[email protected]","text-3":"+49 +49 123 45678","textarea-1":"Test","cr-field":"MHwyOHA4cjNuMDc0czhxcXMwODU4bnFxNTQ3bzlycDM4M3M1cDk4MG4z"}
Thu, 01 Feb 2024 13:08:54 +0100 [DEBUG] request="19c4ec7b1b692" component="Derhansen.FormCrshield.Hooks.Form": CR response expired. Submitted data - {"text-1":"Oliver Klee","DZ7Fyhu1ivOeLGbaW3nXrmq":"","text-2":"[email protected]","text-3":"+49 +49 123 45678","textarea-1":"Test","cr-field":"MHwyOHA4cjNuMDc0czhxcXMwODU4bnFxNTQ3bzlycDM4M3M1cDk4MG4z"}
Thu, 01 Feb 2024 13:08:54 +0100 [DEBUG] request="19c4ec7b1b692" component="Derhansen.FormCrshield.Hooks.Form": CR response expired. Submitted data - {"text-1":"Oliver Klee","DZ7Fyhu1ivOeLGbaW3nXrmq":"","text-2":"[email protected]","text-3":"+49 123 45678","textarea-1":"Test","cr-field":"MHwyOHA4cjNuMDc0czhxcXMwODU4bnFxNTQ3bzlycDM4M3M1cDk4MG4z"}

(What stands out to me there is the "CR response expired" message.)

I've checked that FormCrShield.js gets loaded when I load the page and that there are no errors or warnings in the browser console.

Is this a bug, or has version 1.4.0 some breaking change that requires changes to the extension configuration?

And how can I help debug this?

[TASK] Calculate page cache timeout manually

With https://review.typo3.org/c/Packages/TYPO3.CMS/+/82416 the internal function get_cache_timeout() form TSFE got declared protected. Thus it is no longer possible to get the calculated cache timeout for a page and this must now be retreived manually.

Use CacheDataCollector API in v13 - see https://review.typo3.org/c/Packages/TYPO3.CMS/+/81801

Temporarily, the get_cache_timeout function can be copied to the Hook.

[BUG] Summary step does not validate

Hi, nice extension!
it works perfectly fine for normal or multistep forms.
Also good to test with disabled javascript.

I got an issue with summary steps though, which seem not to validate.
The $requestArguments are empty in my case so the validation fails in the afterSubmit function with the CR response invalid. Submitted data logs

EXT:form_crshield/Classes/Hooks/Form.php:72

[FEATURE] Add configurable delay for response calculation

Add a configurable delay for the response calculation, to make it harder for bots with active JavaScript to submit the form

[TASK] Add invalid default value to CR field

Add a useless/invalid default value to the CD field.

[TASK] Always write POST data to debug log

Always write POST data for the current page to debug log

[TASK] Obfuscate included JavaScript

[TASK] Add acceptance test suites

Add acceptance test suites to cover:

Test different forms with chrome webbrowser (selenium/headless)
Test different forms with phpbrowser (no JavaScript)

[TASK] Harden HMAC calculation

[BUG] Form editor preview broken since install of form_crshield

When the extension is installed, the preview in the form editor is broken. The following javascript error occurs:
Uncaught Error: Could not find form element "cr-field" in path "formName/page-1/cr-field" (1472424334)

If the extension is uninstalled it works.
TYPO3 10.4.32
PHP 7.4

I always get different expected vs calculated data in Firefox 121 on mac

On Firefox:

2023-12-30_15-31-32.mp4

Same form in chrome works:

2023-12-30_15-33-00.mp4

After some modifications the log contains this (for firefox):

// Form.php line 82 ff to get better insight into debugging

        if ($calculatedData !== $clientData) {
            $this->logger->debug(
                'CR response missmatch. Submitted data',
                [
                    'calculatedData' => $calculatedData,
                    'expectedData' => $clientData
                ]
            );
            return '';
        }

Sat, 30 Dec 2023 15:28:02 +0100 [DEBUG] request="6c4e5ff2ae00d" component="Derhansen.FormCrshield.Hooks.Form": CR response missmatch. Submitted data - {"calculatedData":"8111n9r3sr0p5s4p4pr245052nr0669n57s285q9","expectedData":"8111a9e3fe0c5f4c4ce245052ae0669a57f285d9"}


And the js:

```javascript
// FormCrShield.js line 15 - the result was visible in the screencast

      console.log(element.value);

I doubt, some strange bug is causing a difference in the calculation of the javascript. Will try to reproduce that on a clean profile of firefox as well.

Validation fails after submit of incomplete/invalid form's data

Steps to reproduce:

Make a for with just 1 single mandatory field.
Submit that form with empty required field
You'll land on form with validation errors. Complete requires field and submit.
CR validation will fails and none of form's finishers will be executed

From what I can see the reason is following:

When form is generated for a first time it generates challene AAA with timestamp 1000.
JS transforms it into 1000|BBB
On invalid form submit form hook validates str_rot13('BBB')==='AAA' as valid. Anf in the same time generates the new challenge: 2000|CCC
Next I'm not sure, but most probably Form applies POST data to the cr-field and fenerates form with required field validation errors. It measn that form sends to client "1000|BBB" as a challenge anstead of new "2000|CCC"
JS on the client side transforms "1000|BBB" into "1000|AAA"
When client submits data CR from handler retrieves challenge for timestamp 1000 from the request which is "AAA" and fails validation with str_rot13('AAA')!=='AAA'

TYPO3 10 LTS compatibility

Hi Torben!

Are you interested into v10 compatibility? I can provide a PR if you don't mind.

override for given form

Is it possibly to setup a given form that is not protected by this extension even if the extension is installed and present.
I have a form with topwire and summary and sometimes I can´t submit the last step and my guess is that form_crshield is causing this. No issues if I uninstall form_crshield.