mirror of
https://git.pleroma.social/pleroma/pleroma.git
synced 2024-12-23 08:36:29 +00:00
Merge branch 'fix/csp-for-captcha' into 'develop'
Add Captcha endpoint to CSP headers when MediaProxy is enabled. See merge request pleroma/pleroma!2718
This commit is contained in:
commit
6b14f0c514
2 changed files with 22 additions and 11 deletions
|
@ -81,6 +81,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
||||||
- `blob:` urls not being allowed by connect-src CSP
|
- `blob:` urls not being allowed by connect-src CSP
|
||||||
- Mastodon API: fix `GET /api/v1/notifications` not returning the full result set
|
- Mastodon API: fix `GET /api/v1/notifications` not returning the full result set
|
||||||
- Rich Media Previews for Twitter links
|
- Rich Media Previews for Twitter links
|
||||||
|
- Fix CSP policy generation to include remote Captcha services
|
||||||
|
|
||||||
## [Unreleased (patch)]
|
## [Unreleased (patch)]
|
||||||
|
|
||||||
|
|
|
@ -69,10 +69,11 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
||||||
img_src = "img-src 'self' data: blob:"
|
img_src = "img-src 'self' data: blob:"
|
||||||
media_src = "media-src 'self'"
|
media_src = "media-src 'self'"
|
||||||
|
|
||||||
|
# Strict multimedia CSP enforcement only when MediaProxy is enabled
|
||||||
{img_src, media_src} =
|
{img_src, media_src} =
|
||||||
if Config.get([:media_proxy, :enabled]) &&
|
if Config.get([:media_proxy, :enabled]) &&
|
||||||
!Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
|
!Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
|
||||||
sources = get_proxy_and_attachment_sources()
|
sources = build_csp_multimedia_source_list()
|
||||||
{[img_src, sources], [media_src, sources]}
|
{[img_src, sources], [media_src, sources]}
|
||||||
else
|
else
|
||||||
{[img_src, " https:"], [media_src, " https:"]}
|
{[img_src, " https:"], [media_src, " https:"]}
|
||||||
|
@ -107,29 +108,28 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
||||||
|> :erlang.iolist_to_binary()
|
|> :erlang.iolist_to_binary()
|
||||||
end
|
end
|
||||||
|
|
||||||
defp get_proxy_and_attachment_sources do
|
defp build_csp_multimedia_source_list do
|
||||||
media_proxy_whitelist =
|
media_proxy_whitelist =
|
||||||
Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
|
Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
|
||||||
add_source(acc, host)
|
add_source(acc, host)
|
||||||
end)
|
end)
|
||||||
|
|
||||||
media_proxy_base_url =
|
media_proxy_base_url = build_csp_param(Config.get([:media_proxy, :base_url]))
|
||||||
if Config.get([:media_proxy, :base_url]),
|
|
||||||
do: URI.parse(Config.get([:media_proxy, :base_url])).host
|
|
||||||
|
|
||||||
upload_base_url =
|
upload_base_url = build_csp_param(Config.get([Pleroma.Upload, :base_url]))
|
||||||
if Config.get([Pleroma.Upload, :base_url]),
|
|
||||||
do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host
|
|
||||||
|
|
||||||
s3_endpoint =
|
s3_endpoint = build_csp_param(Config.get([Pleroma.Uploaders.S3, :public_endpoint]))
|
||||||
if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
|
|
||||||
do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host
|
captcha_method = Config.get([Pleroma.Captcha, :method])
|
||||||
|
|
||||||
|
captcha_endpoint = build_csp_param(Config.get([captcha_method, :endpoint]))
|
||||||
|
|
||||||
[]
|
[]
|
||||||
|> add_source(media_proxy_base_url)
|
|> add_source(media_proxy_base_url)
|
||||||
|> add_source(upload_base_url)
|
|> add_source(upload_base_url)
|
||||||
|> add_source(s3_endpoint)
|
|> add_source(s3_endpoint)
|
||||||
|> add_source(media_proxy_whitelist)
|
|> add_source(media_proxy_whitelist)
|
||||||
|
|> add_source(captcha_endpoint)
|
||||||
end
|
end
|
||||||
|
|
||||||
defp add_source(iodata, nil), do: iodata
|
defp add_source(iodata, nil), do: iodata
|
||||||
|
@ -139,6 +139,16 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
|
||||||
|
|
||||||
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
|
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
|
||||||
|
|
||||||
|
defp build_csp_param(nil), do: nil
|
||||||
|
|
||||||
|
defp build_csp_param(url) when is_binary(url) do
|
||||||
|
%{host: host, scheme: scheme} = URI.parse(url)
|
||||||
|
|
||||||
|
if scheme do
|
||||||
|
[scheme, "://", host]
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
def warn_if_disabled do
|
def warn_if_disabled do
|
||||||
unless Config.get([:http_security, :enabled]) do
|
unless Config.get([:http_security, :enabled]) do
|
||||||
Logger.warn("
|
Logger.warn("
|
||||||
|
|
Loading…
Reference in a new issue