csrf-attacker

Detection Targets

Type	Description	Pattern
csrf-token-missing	CSRFトークン欠如	フォームに@csrf/csrf_token等なし
csrf-protection-disabled	CSRF保護の意図的無効化	@csrf_exempt, skip_verify等
samesite-cookie-missing	SameSite Cookie未設定	SameSite=None or 未指定
state-change-unprotected	状態変更操作の保護不備	POST/PUT/DELETEにCSRF保護なし

Framework Detection Patterns

Framework	Vulnerable Pattern	Safe Pattern
Laravel	Form without @csrf	@csrf directive, VerifyCsrfToken middleware
Django	@csrf_exempt decorator	CsrfViewMiddleware, {% csrf_token %}
Flask	WTForms without csrf	CSRFProtect, validate_csrf()
Express	No csurf middleware	csurf(), csrf() middleware
Rails	skip_before_action :verify_authenticity_token	protect_from_forgery, csrf_meta_tags

Dangerous Patterns

patterns:
  # Laravel - CSRF token missing
  - '<form[^>]{0,500}method\s*=\s*["\']?(POST|PUT|DELETE)["\']?[^>]{0,500}>'
  - 'VerifyCsrfToken.{0,100}\$except'

  # Django - CSRF protection disabled
  - '@csrf_exempt'
  - 'MIDDLEWARE\s*=\s*\[(?![^\]]*CsrfViewMiddleware)'

  # Flask - No CSRF protection
  - 'FlaskForm.{0,50}csrf.{0,20}False'
  - 'WTF_CSRF_ENABLED\s*=\s*False'

  # Express - No csurf middleware
  - 'app\.(post|put|delete|patch)\s*\([^)]{1,200}\)'
  - 'router\.(post|put|delete|patch)\s*\([^)]{1,200}\)'

  # Rails - CSRF protection disabled
  - 'skip_before_action\s*:verify_authenticity_token'
  - 'protect_from_forgery.{0,50}except:'

  # SameSite Cookie issues (only flag None without Secure)
  - 'SameSite\s*=\s*None(?!.{0,30}Secure)'
  - 'samesite\s*:\s*["\']none["\'](?!.{0,30}secure)'

  # AJAX/REST API patterns
  - 'fetch\s*\([^,]+,\s*\{[^}]*method:\s*["\']?(POST|PUT|DELETE|PATCH)'
  - 'axios\.(post|put|delete|patch)\s*\('
  - '\$\.(ajax|post)\s*\('

Safe Patterns

safe_patterns:
  # Laravel
  - '@csrf'
  - 'csrf_field()'
  - 'csrf_token()'
  # Django
  - '{% csrf_token %}'
  - 'CsrfViewMiddleware'
  # Flask
  - 'CSRFProtect'
  - 'validate_csrf'
  # Express
  - 'csurf()'
  - 'csrf()'
  # Rails
  - 'protect_from_forgery'
  - 'csrf_meta_tags'
  # SameSite - safe
  - 'SameSite\s*=\s*(Strict|Lax)'
  - 'SameSite\s*=\s*None.{0,30}Secure'
  # Custom header verification
  - 'X-Requested-With'
  - 'X-CSRF-Token'
  - 'Authorization:\s*Bearer'
  # Double-submit cookie pattern
  - 'csrf.*cookie.*header'
  - 'cookie.*csrf.*match'