mirrors/pleroma
1
0
Fork 0
mirror of https://git.pleroma.social/pleroma/pleroma.git synced 2024-06-22 23:20:48 +00:00
Code Issues Projects Releases Wiki Activity

conditionally set csp depnding on media-proxy state

Browse source
This commit is contained in:
Henry Jameson 2023-05-07 15:16:30 +03:00
parent cd20d15bb8
commit c0d11da2d8
1 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
lib/pleroma/web/plugs/http_security_plug.ex
View file

@ -93,18 +93,26 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
img_src = "img-src 'self' data: blob:" img_src = "img-src 'self' data: blob:"
media_src = "media-src 'self'" media_src = "media-src 'self'"
connect_src = ["connect-src 'self' blob:", static_url, ?\s, websocket_url]
# Strict multimedia CSP enforcement only when MediaProxy is enabled # Strict multimedia CSP enforcement only when MediaProxy is enabled
{img_src, media_src} = {img_src, media_src, connect_src} =
if Config.get([:media_proxy, :enabled]) && if Config.get([:media_proxy, :enabled]) &&
!Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
sources = build_csp_multimedia_source_list() sources = build_csp_multimedia_source_list()
{[img_src, sources], [media_src, sources]} {
[img_src, sources],
[media_src, sources],
[connect_src, sources]
}
else else
{[img_src, " https:"], [media_src, " https:"]} {
[img_src, " https:"],
[media_src, " https:"],
[connect_src, " https:"]
}
end end
connect_src = ["connect-src 'self' blob: https: ", static_url, ?\s, websocket_url]
connect_src = connect_src =
if Config.get(:env) == :dev do if Config.get(:env) == :dev do