Merge branch 'fix-graphiql' into 'master'

Fix GraphiQL CSP headers and replace with graphql-playground

Closes #708

See merge request framasoft/mobilizon!963

.sobelow-skips

@@ -6,4 +6,5 @@
 81C1F600C5809C7029EE32DE4818CD7D
 155A1FB53DE39EC8EFCFD7FB94EA823D
 73B351E4CB3AF715AD450A085F5E6304
-BBACD7F0BACD4A6D3010C26604671692
+BBACD7F0BACD4A6D3010C26604671692
+6D4D4A4821B93BCFAC9CDBB367B34C4B

lib/web/plugs/http_security_plug.ex

@@ -15,25 +15,26 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
   def init(opts), do: opts
 
-  def call(conn, _options) do
+  def call(conn, options \\ []) do
     if Config.get([:http_security, :enabled]) do
       conn
-      |> merge_resp_headers(headers())
+      |> merge_resp_headers(headers(options))
       |> maybe_send_sts_header(Config.get([:http_security, :sts]))
     else
       conn
     end
   end
 
-  defp headers do
+  defp headers(options) do
-    referrer_policy = Config.get([:http_security, :referrer_policy])
+    referrer_policy =
+      Keyword.get(options, :referrer_policy, Config.get([:http_security, :referrer_policy]))
 
     [
       {"x-xss-protection", "0"},
       {"x-frame-options", "DENY"},
       {"x-content-type-options", "nosniff"},
       {"referrer-policy", referrer_policy},
-      {"content-security-policy", csp_string()}
+      {"content-security-policy", csp_string(options)}
     ]
   end
 
@@ -55,14 +56,14 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
   @style_src "style-src 'self' "
   @font_src "font-src 'self' "
 
-  defp csp_string do
+  defp csp_string(options) do
-    scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
+    scheme = Keyword.get(options, :scheme, Config.get([Pleroma.Web.Endpoint, :url])[:scheme])
     static_url = Mobilizon.Web.Endpoint.static_url()
     websocket_url = Mobilizon.Web.Endpoint.websocket_url()
 
-    img_src = [@img_src | get_csp_config(:img_src)]
+    img_src = [@img_src | get_csp_config(:img_src, options)]
 
-    media_src = [@media_src | get_csp_config(:media_src)]
+    media_src = [@media_src | get_csp_config(:media_src, options)]
 
     connect_src = [
       @connect_src,
@@ -70,7 +71,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
       ?\s,
       websocket_url,
       ?\s,
-      get_csp_config(:connect_src)
+      get_csp_config(:connect_src, options)
     ]
 
     script_src =
@@ -83,19 +84,22 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
         ]
       end
 
-    script_src = [script_src | get_csp_config(:script_src)]
+    script_src = [script_src | get_csp_config(:script_src, options)]
 
-    style_src = [@style_src | get_csp_config(:style_src)]
+    style_src =
+      if Config.get(:env) == :dev, do: [@style_src | "'unsafe-inline' "], else: @style_src
 
-    font_src = [@font_src | get_csp_config(:font_src)]
+    style_src = [style_src | get_csp_config(:style_src, options)]
+
+    font_src = [@font_src | get_csp_config(:font_src, options)]
 
     frame_src = if Config.get(:env) == :dev, do: "frame-src 'self' ", else: "frame-src 'none' "
-    frame_src = [frame_src | get_csp_config(:frame_src)]
+    frame_src = [frame_src | get_csp_config(:frame_src, options)]
 
     frame_ancestors =
       if Config.get(:env) == :dev, do: "frame-ancestors 'self' ", else: "frame-ancestors 'none' "
 
-    frame_ancestors = [frame_ancestors | get_csp_config(:frame_ancestors)]
+    frame_ancestors = [frame_ancestors | get_csp_config(:frame_ancestors, options)]
 
     insecure = if scheme == "https", do: "upgrade-insecure-requests"
 
@@ -126,6 +130,9 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
   defp maybe_send_sts_header(conn, _), do: conn
 
-  defp get_csp_config(type),
+  defp get_csp_config(type, options) do
-    do: [:http_security, :csp_policy, type] |> Config.get() |> Enum.join(" ")
+    options
+    |> Keyword.get(type, Config.get([:http_security, :csp_policy, type]))
+    |> Enum.join(" ")
+  end
 end

lib/web/router.ex

@@ -9,6 +9,16 @@ defmodule Mobilizon.Web.Router do
     plug(Mobilizon.Web.Auth.Pipeline)
   end
 
+  pipeline :graphiql do
+    plug(Mobilizon.Web.Auth.Pipeline)
+
+    plug(Mobilizon.Web.Plugs.HTTPSecurityPlug,
+      script_src: ["cdn.jsdelivr.net"],
+      style_src: ["cdn.jsdelivr.net"],
+      font_src: ["cdn.jsdelivr.net"]
+    )
+  end
+
   pipeline :host_meta do
     plug(:accepts, ["xrd-xml"])
   end
@@ -144,8 +154,12 @@ defmodule Mobilizon.Web.Router do
 
   ## MOBILIZON
   scope "/graphiql" do
-    pipe_through(:graphql)
+    pipe_through(:graphiql)
-    forward("/", Absinthe.Plug.GraphiQL, schema: Mobilizon.GraphQL.Schema)
+
+    forward("/", Absinthe.Plug.GraphiQL,
+      schema: Mobilizon.GraphQL.Schema,
+      interface: :playground
+    )
   end
 
   scope "/", Mobilizon.Web do