[stimulus-bundle] Use get/setAttribute() to change the value of hidde…

…n CSRF fields
symfony · Jan 5, 2025 · 5424f0f · 5424f0f
1 parent 5f3e6c5
commit 5424f0f
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/symfony/stimulus-bundle/2.20/assets/controllers/csrf_protection_controller.js b/symfony/stimulus-bundle/2.20/assets/controllers/csrf_protection_controller.js
@@ -10,11 +10,11 @@ document.addEventListener('submit', function (event) {
     }
 
     var csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
-    var csrfToken = csrfField.value;
+    var csrfToken = csrfField.getAttribute('value');
 
     if (!csrfCookie && nameCheck.test(csrfToken)) {
         csrfField.setAttribute('data-csrf-protection-cookie-value', csrfCookie = csrfToken);
-        csrfField.value = csrfToken = btoa(String.fromCharCode.apply(null, (window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18))));
+        csrfField.setAttribute('value', csrfToken = btoa(String.fromCharCode.apply(null, (window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18)))));
     }
 
     if (csrfCookie && tokenCheck.test(csrfToken)) {
@@ -34,8 +34,8 @@ document.addEventListener('turbo:submit-start', function (event) {
 
     var csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
 
-    if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
-        event.detail.formSubmission.fetchRequest.headers[csrfCookie] = csrfField.value;
+    if (tokenCheck.test(csrfField.getAttribute('value')) && nameCheck.test(csrfCookie)) {
+        event.detail.formSubmission.fetchRequest.headers[csrfCookie] = csrfField.getAttribute('value');
     }
 });
 
@@ -49,8 +49,8 @@ document.addEventListener('turbo:submit-end', function (event) {
 
     var csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
 
-    if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
-        var cookie = csrfCookie + '_' + csrfField.value + '=0; path=/; samesite=strict; max-age=0';
+    if (tokenCheck.test(csrfField.getAttribute('value')) && nameCheck.test(csrfCookie)) {
+        var cookie = csrfCookie + '_' + csrfField.getAttribute('value') + '=0; path=/; samesite=strict; max-age=0';
 
         document.cookie = window.location.protocol === 'https:' ? '__Host-' + cookie + '; secure' : cookie;
     }