fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#3149)

A TokenLookup whose sources are all unknown (for example "nope:nope")
parsed without error but yielded zero extractors. With nothing to
check, unsafe requests were let through without any token validation.
Fail middleware creation instead, so the misconfiguration surfaces at
startup.

Backport of #3067.

Author: orinnz

middleware/csrf.go

@@ -5,6 +5,7 @@ package middleware
 
 import (
 	"crypto/subtle"
+	"errors"
 	"net/http"
 	"slices"
 	"strings"
@@ -165,6 +166,9 @@ func (config CSRFConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
 	if cErr != nil {
 		return nil, cErr
 	}
+	if len(extractors) == 0 {
+		return nil, errors.New("echo csrf middleware could not create extractors from TokenLookup string")
+	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {

middleware/csrf_test.go

@@ -156,6 +156,14 @@ func TestCSRF_tokenExtractors(t *testing.T) {
 			givenQueryTokens:        map[string][]string{},
 			expectToMiddlewareError: "extractor source for lookup could not be split into needed parts: q",
 		},
+		{
+			name:                    "nok, TokenLookup with only unknown source yields no extractors",
+			whenTokenLookup:         "nope:nope",
+			givenCSRFCookie:         "token",
+			givenMethod:             http.MethodPut,
+			givenQueryTokens:        map[string][]string{},
+			expectToMiddlewareError: "echo csrf middleware could not create extractors from TokenLookup string",
+		},
 	}
 
 	for _, tc := range testCases {