Tokens are not injected into dynamically created DOM elements

[forgedhallpass]

Some applications or libraries might dynamically create DOM elements, for which the current solution does not cater for.
(e.g. some versions of ExtJS create a FORM element inside an IFRAME to handle file uploads

This specific scenario could be solved by creating a MutationObserver, then inject the tokens to the newly created elements if applicable. Adding such an observer/listener might have a significant impact on the performance, so this should be made configurable through the properties file.

[forgedhallpass]

Since the default MutationObserver implementation is asynchronous, there might be corner-case race conditions between dynamically created and submitted forms and the time the MutationObserver is being invoked by the browser. In order to cater for this special case, a configurable event can be introduced because JavaScript events are executed synchronously. After a dynamic DOM element creation which requires token injection the integrator client has to manually fire an event with the name defined in the properties file.

[forgedhallpass]

Fixed by:

• OWASP/www-project-csrfguard@9c9f855
• OWASP/www-project-csrfguard@d590ae9