Merge branch 'add-csp-policy-for-pictures' into 'main'

Add CSP Policy for pictures

See merge request framasoft/mobilizon!1318
This commit is contained in:
Thomas Citharel 2022-11-04 10:24:21 +00:00
commit b1cc1a9155
5 changed files with 73 additions and 11 deletions

View file

@ -88,6 +88,8 @@ config :mobilizon, Mobilizon.Web.Gettext, allowed_locales: ["fr", "en", "es", "r
config :junit_formatter, report_dir: "."
config :mobilizon, :http_security, report_uri: "https://endpoint.com"
if System.get_env("DOCKER", "false") == "false" && File.exists?("./config/test.secret.exs") do
import_config "test.secret.exs"
end

View file

@ -29,8 +29,12 @@ defmodule Mobilizon.Service.Pictures.Provider do
iex> search("London")
%Information{url: "https://some_url_to.a/picture.jpeg", author: %{name: "An author", url: "https://url.to/profile"}, source: %{name: "The source name", url: "The source URL" }}
"""
@callback search(location :: String.t(), options :: keyword) ::
[Information.t()]
@callback search(location :: String.t(), options :: keyword) :: Information.t()
@doc """
The CSP configuration to add for the service to work
"""
@callback csp() :: keyword()
@spec endpoint(atom()) :: String.t()
def endpoint(provider) do

View file

@ -16,7 +16,7 @@ defmodule Mobilizon.Service.Pictures.Unsplash do
@doc """
Unsplash implementation for `c:Mobilizon.Service.Geospatial.Provider.geocode/3`.
"""
@spec search(String.t(), keyword()) :: list(Information.t())
@spec search(String.t(), keyword()) :: Information.t()
def search(location, _options \\ []) do
url = "#{unsplash_endpoint()}#{@unsplash_api}?query=#{location}&orientation=landscape"
@ -42,6 +42,16 @@ defmodule Mobilizon.Service.Pictures.Unsplash do
end
end
@impl Provider
@doc """
Returns the CSP configuration for this search provider to work
"""
def csp do
:mobilizon
|> Application.get_env(__MODULE__, [])
|> Keyword.get(:csp_policy, [])
end
defp unsplash_app_name do
Application.get_env(:mobilizon, __MODULE__) |> get_in([:app_name])
end

View file

@ -9,8 +9,8 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
"""
alias Mobilizon.Config
alias Mobilizon.Service.FrontEndAnalytics
alias Mobilizon.Service.GlobalSearch
alias Mobilizon.Service.{FrontEndAnalytics, GlobalSearch, Pictures}
alias Mobilizon.Web.Endpoint
import Plug.Conn
require Logger
@ -34,13 +34,32 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
referrer_policy =
Keyword.get(options, :referrer_policy, Config.get([:http_security, :referrer_policy]))
[
report_uri = Config.get([:http_security, :report_uri])
headers = [
{"x-xss-protection", "0"},
{"x-frame-options", "DENY"},
{"x-content-type-options", "nosniff"},
{"referrer-policy", referrer_policy},
{"content-security-policy", csp_string(options)}
]
if report_uri do
report_group = %{
"group" => "csp-endpoint",
"max-age" => 10_886_400,
"endpoints" => [
%{"url" => report_uri}
]
}
[
{"report-to", Jason.encode!(report_group)},
{"reporting-endpoints", "csp-endpoint=\"#{report_uri}\""} | headers
]
else
headers
end
end
@static_csp_rules [
@ -62,9 +81,10 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
@spec csp_string(Keyword.t()) :: String.t()
defp csp_string(options) do
scheme = Keyword.get(options, :scheme, Config.get([Pleroma.Web.Endpoint, :url])[:scheme])
static_url = Mobilizon.Web.Endpoint.static_url()
websocket_url = Mobilizon.Web.Endpoint.websocket_url()
scheme = Keyword.get(options, :scheme, Config.get([Endpoint, :url])[:scheme])
static_url = Endpoint.static_url()
websocket_url = Endpoint.websocket_url()
report_uri = Config.get([:http_security, :report_uri])
img_src = [@img_src] ++ [get_csp_config(:img_src, options)]
@ -107,6 +127,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
frame_ancestors = [frame_ancestors] ++ [get_csp_config(:frame_ancestors, options)]
report = if report_uri, do: ["report-uri ", report_uri, " ; report-to csp-endpoint"]
insecure = if scheme == "https", do: "upgrade-insecure-requests"
@csp_start
@ -119,6 +140,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
|> add_csp_param(frame_src)
|> add_csp_param(frame_ancestors)
|> add_csp_param(insecure)
|> add_csp_param(report)
|> to_string()
end
@ -142,7 +164,11 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
config_policy = Keyword.get(options, type, Config.get([:http_security, :csp_policy, type]))
front_end_analytics_policy = [Keyword.get(FrontEndAnalytics.csp(), type, [])]
global_search_policy = [Keyword.get(GlobalSearch.service().csp(), type, [])]
pictures_policy = [Keyword.get(Pictures.service().csp(), type, [])]
Enum.join(config_policy ++ front_end_analytics_policy ++ global_search_policy, " ")
Enum.join(
config_policy ++ front_end_analytics_policy ++ global_search_policy ++ pictures_policy,
" "
)
end
end

View file

@ -49,6 +49,26 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"]
end
test "it sends `report-to`, `reporting-endpoints` & `report-uri` CSP response headers", %{
conn: conn
} do
conn = post(conn, "/api")
[csp] = Conn.get_resp_header(conn, "content-security-policy")
assert csp =~ ~r|report-uri https://endpoint.com ; report-to csp-endpoint;|
[report_to] = Conn.get_resp_header(conn, "report-to")
assert report_to ==
"{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
[reporting_endpoints] = Conn.get_resp_header(conn, "reporting-endpoints")
assert reporting_endpoints ==
"csp-endpoint=\"https://endpoint.com\""
end
test "default values for content-security-policy are always included", %{conn: conn} do
conn = post(conn, "/api")
@ -73,7 +93,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
[csp] = Conn.get_resp_header(conn, "content-security-policy")
assert csp =~
~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com ;/
~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com\s+;/
end
end