fix(middleware): reject CSRF TokenLookup that produces no extractors

Author: Reeeid

middleware/csrf.go

@@ -5,6 +5,7 @@ package middleware
 
 import (
 	"crypto/subtle"
+	"errors"
 	"net/http"
 	"slices"
 	"strings"
@@ -160,6 +161,9 @@ func (config CSRFConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
 	if cErr != nil {
 		return nil, cErr
 	}
+	if len(extractors) == 0 {
+		return nil, errors.New("echo csrf middleware could not create extractors from TokenLookup string")
+	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c *echo.Context) error {

middleware/csrf_test.go

@@ -159,6 +159,14 @@ func TestCSRF_tokenExtractors(t *testing.T) {
 			givenQueryTokens:        map[string][]string{},
 			expectToMiddlewareError: "extractor source for lookup could not be split into needed parts: q",
 		},
+		{
+			name:                    "nok, TokenLookup with only unknown source yields no extractors",
+			whenTokenLookup:         "nope:nope",
+			givenCSRFCookie:         "token",
+			givenMethod:             http.MethodPut,
+			givenQueryTokens:        map[string][]string{},
+			expectToMiddlewareError: "echo csrf middleware could not create extractors from TokenLookup string",
+		},
 	}
 
 	for _, tc := range testCases {