|
|
@ -31,7 +31,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
|
|
|
{"x-content-type-options", "nosniff"},
|
|
|
|
{"x-content-type-options", "nosniff"},
|
|
|
|
{"referrer-policy", referrer_policy},
|
|
|
|
{"referrer-policy", referrer_policy},
|
|
|
|
{"x-download-options", "noopen"},
|
|
|
|
{"x-download-options", "noopen"},
|
|
|
|
{"content-security-policy", csp_string() <> ";"}
|
|
|
|
{"content-security-policy", csp_string()}
|
|
|
|
]
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
if report_uri do
|
|
|
|
if report_uri do
|
|
|
@ -43,23 +43,46 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
|
|
|
]
|
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
headers ++ [{"reply-to", Jason.encode!(report_group)}]
|
|
|
|
[{"reply-to", Jason.encode!(report_group)} | headers]
|
|
|
|
else
|
|
|
|
else
|
|
|
|
headers
|
|
|
|
headers
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static_csp_rules = [
|
|
|
|
|
|
|
|
"default-src 'none'",
|
|
|
|
|
|
|
|
"base-uri 'self'",
|
|
|
|
|
|
|
|
"frame-ancestors 'none'",
|
|
|
|
|
|
|
|
"style-src 'self' 'unsafe-inline'",
|
|
|
|
|
|
|
|
"font-src 'self'",
|
|
|
|
|
|
|
|
"manifest-src 'self'"
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@csp_start [Enum.join(static_csp_rules, ";") <> ";"]
|
|
|
|
|
|
|
|
|
|
|
|
defp csp_string do
|
|
|
|
defp csp_string do
|
|
|
|
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
|
|
|
|
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
|
|
|
|
static_url = Pleroma.Web.Endpoint.static_url()
|
|
|
|
static_url = Pleroma.Web.Endpoint.static_url()
|
|
|
|
websocket_url = Pleroma.Web.Endpoint.websocket_url()
|
|
|
|
websocket_url = Pleroma.Web.Endpoint.websocket_url()
|
|
|
|
report_uri = Config.get([:http_security, :report_uri])
|
|
|
|
report_uri = Config.get([:http_security, :report_uri])
|
|
|
|
|
|
|
|
|
|
|
|
connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
|
|
|
|
img_src = "img-src 'self' data: blob:"
|
|
|
|
|
|
|
|
media_src = "media-src 'self'"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
{img_src, media_src} =
|
|
|
|
|
|
|
|
if Config.get([:media_proxy, :enabled]) &&
|
|
|
|
|
|
|
|
!Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
|
|
|
|
|
|
|
|
sources = get_proxy_and_attachment_sources()
|
|
|
|
|
|
|
|
{[img_src, sources], [media_src, sources]}
|
|
|
|
|
|
|
|
else
|
|
|
|
|
|
|
|
{img_src, media_src}
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]
|
|
|
|
|
|
|
|
|
|
|
|
connect_src =
|
|
|
|
connect_src =
|
|
|
|
if Pleroma.Config.get(:env) == :dev do
|
|
|
|
if Pleroma.Config.get(:env) == :dev do
|
|
|
|
connect_src <> " http://localhost:3035/"
|
|
|
|
[connect_src, " http://localhost:3035/"]
|
|
|
|
else
|
|
|
|
else
|
|
|
|
connect_src
|
|
|
|
connect_src
|
|
|
|
end
|
|
|
|
end
|
|
|
@ -71,27 +94,46 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
|
|
|
"script-src 'self'"
|
|
|
|
"script-src 'self'"
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
main_part = [
|
|
|
|
report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
|
|
|
|
"default-src 'none'",
|
|
|
|
insecure = if scheme == "https", do: "upgrade-insecure-requests"
|
|
|
|
"base-uri 'self'",
|
|
|
|
|
|
|
|
"frame-ancestors 'none'",
|
|
|
|
@csp_start
|
|
|
|
"img-src 'self' data: blob: https:",
|
|
|
|
|> add_csp_param(img_src)
|
|
|
|
"media-src 'self' https:",
|
|
|
|
|> add_csp_param(media_src)
|
|
|
|
"style-src 'self' 'unsafe-inline'",
|
|
|
|
|> add_csp_param(connect_src)
|
|
|
|
"font-src 'self'",
|
|
|
|
|> add_csp_param(script_src)
|
|
|
|
"manifest-src 'self'",
|
|
|
|
|> add_csp_param(insecure)
|
|
|
|
connect_src,
|
|
|
|
|> add_csp_param(report)
|
|
|
|
script_src
|
|
|
|
|> :erlang.iolist_to_binary()
|
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
defp get_proxy_and_attachment_sources do
|
|
|
|
|
|
|
|
media_proxy_whitelist =
|
|
|
|
|
|
|
|
Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
|
|
|
|
|
|
|
|
add_source(acc, host)
|
|
|
|
|
|
|
|
end)
|
|
|
|
|
|
|
|
|
|
|
|
report = if report_uri, do: ["report-uri #{report_uri}; report-to csp-endpoint"], else: []
|
|
|
|
upload_base_url =
|
|
|
|
|
|
|
|
if Config.get([Pleroma.Upload, :base_url]),
|
|
|
|
|
|
|
|
do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host
|
|
|
|
|
|
|
|
|
|
|
|
insecure = if scheme == "https", do: ["upgrade-insecure-requests"], else: []
|
|
|
|
s3_endpoint =
|
|
|
|
|
|
|
|
if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
|
|
|
|
|
|
|
|
do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host
|
|
|
|
|
|
|
|
|
|
|
|
(main_part ++ report ++ insecure)
|
|
|
|
[]
|
|
|
|
|> Enum.join("; ")
|
|
|
|
|> add_source(upload_base_url)
|
|
|
|
|
|
|
|
|> add_source(s3_endpoint)
|
|
|
|
|
|
|
|
|> add_source(media_proxy_whitelist)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
defp add_source(iodata, nil), do: iodata
|
|
|
|
|
|
|
|
defp add_source(iodata, source), do: [[?\s, source] | iodata]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
defp add_csp_param(csp_iodata, nil), do: csp_iodata
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
|
|
|
|
|
|
|
|
|
|
|
|
def warn_if_disabled do
|
|
|
|
def warn_if_disabled do
|
|
|
|
unless Config.get([:http_security, :enabled]) do
|
|
|
|
unless Config.get([:http_security, :enabled]) do
|
|
|
|
Logger.warn("
|
|
|
|
Logger.warn("
|
|
|
|