From fc1661dc6151e7ffda90d7cd672b5fe7cc51220f Mon Sep 17 00:00:00 2001
From: Reeeid <195305112+Reeeid@users.noreply.github.com>
Date: Thu, 20 Aug 2026 14:31:07 +0900
Subject: [PATCH] fix(middleware): reject CSRF TokenLookup that produces no
 extractors

---
 middleware/csrf.go      | 4 ++++
 middleware/csrf_test.go | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/middleware/csrf.go b/middleware/csrf.go
index 91ac5e41f..3999a92c9 100644
--- a/middleware/csrf.go
+++ b/middleware/csrf.go
@@ -5,6 +5,7 @@ package middleware
 
 import (
 	"crypto/subtle"
+	"errors"
 	"net/http"
 	"slices"
 	"strings"
@@ -160,6 +161,9 @@ func (config CSRFConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
 	if cErr != nil {
 		return nil, cErr
 	}
+	if len(extractors) == 0 {
+		return nil, errors.New("echo csrf middleware could not create extractors from TokenLookup string")
+	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c *echo.Context) error {
diff --git a/middleware/csrf_test.go b/middleware/csrf_test.go
index a13fdc82c..1a6b18eda 100644
--- a/middleware/csrf_test.go
+++ b/middleware/csrf_test.go
@@ -159,6 +159,14 @@ func TestCSRF_tokenExtractors(t *testing.T) {
 			givenQueryTokens:        map[string][]string{},
 			expectToMiddlewareError: "extractor source for lookup could not be split into needed parts: q",
 		},
+		{
+			name:                    "nok, TokenLookup with only unknown source yields no extractors",
+			whenTokenLookup:         "nope:nope",
+			givenCSRFCookie:         "token",
+			givenMethod:             http.MethodPut,
+			givenQueryTokens:        map[string][]string{},
+			expectToMiddlewareError: "echo csrf middleware could not create extractors from TokenLookup string",
+		},
 	}
 
 	for _, tc := range testCases {