[LiveComponent] Fix svg re-render - #557
Merged
Merged
Conversation
norkunas
commented
Nov 17, 2022
norkunas
commented
Contributor
| Q | A |
|---|---|
| Bug fix? | no |
| New feature? | no |
| Tickets | #556 |
| License | MIT |
Contributor
|
Thanks for the reproducer test - super useful. I can't think, immediately, what the problem might be - maybe something in morphdom? Unless someone beats me to it (which would be great!) I'll check it out when I have some time. |
Contributor
Author
|
Thought about morphdom too, but they have svg tests,so not sure how this could happen currently.. |
norkunas
force-pushed
the
svg
branch
3 times, most recently
from
November 23, 2022 08:23
a1e6ba9 to
dbc93e8
Compare
norkunas
changed the title
Contributor
Author
|
Found the root cause and added a fix. |
weaverryan
reviewed
Nov 28, 2022
| if ( | ||
| !(fromEl instanceof HTMLElement || fromEl instanceof SVGElement) || | ||
| !(toEl instanceof HTMLElement || toEl instanceof SVGElement) | ||
| ) { |
Contributor
There was a problem hiding this comment.
Nice find. SVG's not being part of HTMLElement is such a pain in the butt :). Thanks for the test case to prevent it from slipping through in the future.
Contributor
|
Thanks Tomas! |
fabpot
pushed a commit
that referenced
this pull request
May 29, 2026
…ent CSRF (Kocal) This PR was merged into the ux-2.x branch. Discussion ---------- [LiveComponent] Require X-Requested-With header to prevent CSRF ## Summary Related to #390. `LiveComponentSubscriber::isLiveComponentRequest()` previously gated requests on the `Accept: application/vnd.live-component+html` header, with a comment claiming this acted as CSRF protection. That claim is wrong: `Accept` is a [CORS-safelisted request header](https://fetch.spec.whatwg.org/#cors-safelisted-request-header) — a cross-origin `fetch()` can set it without triggering a preflight, so the header provides no protection against forged requests. ### Attack illustration Before the fix, a page hosted on `evil.com` could invoke any `#[LiveAction]` on a victim's session: ```http POST /_components/UserSettings/deleteAccount HTTP/1.1 Host: app.example.com Accept: application/vnd.live-component+html Cookie: PHPSESSID=<victim session> Content-Type: multipart/form-data; boundary=... data={"props":{}} ``` The browser sends this request directly (no preflight) because every header used is CORS-safelisted. In practice the attack is mitigated by `SameSite=Lax` session cookies (Symfony default), but apps using `SameSite=None` or `credentials: 'include'` remain exposed. ### Fix Also require `X-Requested-With: XMLHttpRequest`. This header is non-safelisted, so the browser issues a preflight `OPTIONS` request for any cross-origin attempt. Symfony does not advertise CORS for LiveComponent endpoints, the preflight fails, and the browser blocks the real request before it ever reaches the application. The bundled JS client already sends `X-Requested-With` on every request (`src/LiveComponent/assets/src/Backend/RequestBuilder.ts`), so apps relying on the standard Stimulus controller see no change. ### After the fix Cross-origin request with only `Accept` is rejected (treated as not-a-LiveComponent-request → 404): ```http POST /_components/UserSettings/deleteAccount HTTP/1.1 Host: app.example.com Accept: application/vnd.live-component+html → HTTP/1.1 404 Not Found ``` Same request with the non-safelisted header — only reachable from same-origin or via an explicit CORS allow-list — proceeds as before: ```http POST /_components/UserSettings/deleteAccount HTTP/1.1 Host: app.example.com Accept: application/vnd.live-component+html X-Requested-With: XMLHttpRequest → HTTP/1.1 200 OK (or 204 on redirect) ``` ### BC break Minor. Clients that call LiveComponent endpoints from a different origin must add `X-Requested-With` to their CORS `Access-Control-Allow-Headers` allow-list. Apps using the bundled Stimulus controller are not affected. Commits ------- aed7493 [LiveComponent] Require X-Requested-With header to prevent CSRF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.