feat: add disable (#6)

* feat: add disable

* ci: run on ubuntu latest

.github/workflows/test.yml

@@ -2,7 +2,7 @@ on:
   push:
 jobs:
   build:
-    runs-on: ubuntu-16.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         go: [ '1.15', '1.14', '1.13' ]

contract.go

@@ -0,0 +1,33 @@
+package nosurf
+
+import "net/http"
+
+type Handler interface {
+	http.Handler
+	// RegenerateToken regenerates a CSRF token and sets the cookie.
+	RegenerateToken(w http.ResponseWriter, r *http.Request) string
+
+	// ExemptPath will not require CSRF validation but will still set the
+	// cookie if it has not yet been set.
+	ExemptPath(string)
+
+	// IgnorePath will not require CSRF validation and also not set the CSRF
+	// cookie, but it will set the CSRF token (if available) in the request context.
+	IgnorePath(string)
+
+	// IgnoreGlob behaves similar to IgnorePath but allows defining a glob.
+	IgnoreGlob(string)
+
+	// IgnoreGlobs behaves similar to IgnorePath but allows defining globs.
+	IgnoreGlobs(...string)
+
+	// DisablePath will not require CSRF validation and also not set the CSRF
+	// cookie, and it will also not set the CSRF token in the request context.
+	DisablePath(string)
+
+	// DisableGlob behaves similar to DisablePath but allows defining a glob.
+	DisableGlob(string)
+
+	// DisableGlobs behaves similar to DisablePath but allows defining globs.
+	DisableGlobs(...string)
+}

disable.go

@@ -0,0 +1,39 @@
+package nosurf
+
+import (
+	"net/http"
+	pathModule "path"
+)
+
+// Disables the CSRF middleware for an exact path
+// With this you should take note that Go's paths
+// include a leading slash.
+func (h *CSRFHandler) DisablePath(path string) {
+	h.disablePaths = append(h.disablePaths, path)
+}
+
+// Checks if the given request disables this middleware
+func (h *CSRFHandler) IsDisabled(r *http.Request) bool {
+	path := r.URL.Path
+	if sContains(h.disablePaths, path) {
+		return true
+	}
+
+	// then the globs
+	for _, glob := range h.disableGlobs {
+		matched, err := pathModule.Match(glob, path)
+		if matched && err == nil {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (h *CSRFHandler) DisableGlob(pattern string) {
+	h.disableGlobs = append(h.disableGlobs, pattern)
+}
+
+func (h *CSRFHandler) DisableGlobs(patterns ...string) {
+	h.disableGlobs = append(h.disableGlobs, patterns...)
+}

disable_test.go

@@ -0,0 +1,45 @@
+package nosurf
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestDisablePath(t *testing.T) {
+	// the handler doesn't matter here, let's use nil
+	hand := New(nil)
+	path := "/home"
+	exempt, _ := http.NewRequest("GET", path, nil)
+
+	hand.DisablePath(path)
+	if !hand.IsDisabled(exempt) {
+		t.Errorf("%v is not exempt, but it should be", exempt.URL.Path)
+	}
+
+	other, _ := http.NewRequest("GET", "/faq", nil)
+	if hand.IsDisabled(other) {
+		t.Errorf("%v is exempt, but it shouldn't be", other.URL.Path)
+	}
+}
+
+func TestDisableGlob(t *testing.T) {
+	hand := New(nil)
+	glob := "/nail/*"
+
+	hand.DisableGlob(glob)
+
+	test, _ := http.NewRequest("GET", "/nail/foo", nil)
+	if !hand.IsDisabled(test) {
+		t.Errorf("%v should be exempt, but it isn't.", test)
+	}
+
+	test, _ = http.NewRequest("GET", "/nail/foo/bar", nil)
+	if hand.IsDisabled(test) {
+		t.Errorf("%v should not be exempt, but it is.", test)
+	}
+
+	test, _ = http.NewRequest("GET", "/not-nail/foo", nil)
+	if hand.IsDisabled(test) {
+		t.Errorf("%v should not be exempt, but it is.", test)
+	}
+}

handler.go

@@ -60,6 +60,11 @@ type CSRFHandler struct {
 	// ...or a glob (as used by path.Match()).
 	ignoreGlobs []string
 
+	// Slices of paths that completely disable this middleware.
+	disablePaths []string
+	// ...or a glob (as used by path.Match()).
+	disableGlobs []string
+
 	// All of those will be matched against Request.URL.Path,
 	// So they should take the leading slash into account
 }
@@ -121,6 +126,11 @@ func (h CSRFHandler) getCookieName(w http.ResponseWriter, r *http.Request) strin
 }
 
 func (h *CSRFHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if h.IsDisabled(r) {
+		h.handleSuccess(w, r)
+		return
+	}
+
 	r = addNosurfContext(r)
 	defer ctxClear(r)
 
@@ -148,6 +158,7 @@ func (h *CSRFHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	} else {
 		ctxSetToken(r, realToken)
 	}
+
 	if h.IsIgnored(r) {
 		h.handleSuccess(w, r)
 		return