Merge branch 'fix-csp-config' into 'master'

Add config option to setup custom CSP config (and fix it)

Closes #558

See merge request framasoft/mobilizon!808
This commit is contained in:
Thomas Citharel 2021-01-25 18:52:09 +00:00
commit 7283831e08
8 changed files with 154 additions and 12 deletions

View file

@ -57,7 +57,7 @@ lint-elixir:
- export EXITVALUE=0
- mix format --check-formatted --dry-run || export EXITVALUE=1
- mix credo --strict -a || export EXITVALUE=1
- mix sobelow --config --skip || export EXITVALUE=1
- mix sobelow --config || export EXITVALUE=1
- exit $EXITVALUE
lint-front:

View file

@ -7,6 +7,6 @@
format: "txt",
out: "",
threshold: "medium",
ignore: ["Config.HTTPS"],
ignore: ["Config.HTTPS", "Config.CSP"],
ignore_files: ["config/dev.1.secret.exs", "config/dev.2.secret.exs", "config/dev.3.secret.exs", "config/dev.secret.exs", "config/e2e.secret.exs", "config/prod.secret.exs", "config/test.secret.exs"]
]

View file

@ -1,2 +1,2 @@
AACA51671C4B3C803ACBCA3FADE84CDE
752C0E897CA81ACD81F4BB215FA5F8E4

View file

@ -215,6 +215,24 @@ config :mobilizon, :maps,
type: :openstreetmap
]
config :mobilizon, :http_security,
enabled: true,
sts: false,
sts_max_age: 31_536_000,
csp_policy: [
script_src: [],
style_src: [],
connect_src: [],
font_src: [],
img_src: ["*.tile.openstreetmap.org"],
manifest_src: [],
media_src: [],
object_src: [],
frame_src: [],
frame_ancestors: []
],
referrer_policy: "same-origin"
config :mobilizon, :anonymous,
participation: [
allowed: true,

View file

@ -33,6 +33,7 @@
<b-field horizontal :label="$t('Starts on…')" class="begins-on-field">
<b-datetimepicker
class="datepicker starts-on"
:placeholder="$t('Type or select a date…')"
icon="calendar-today"
:locale="$i18n.locale"
@ -45,6 +46,7 @@
<b-field horizontal :label="$t('Ends on…')">
<b-datetimepicker
class="datepicker ends-on"
:placeholder="$t('Type or select a date…')"
icon="calendar-today"
:locale="$i18n.locale"
@ -381,6 +383,12 @@ h2.subtitle {
}
}
.datepicker {
::v-deep .dropdown-menu {
z-index: 200;
}
}
section {
& > .container {
padding: 2rem 1.5rem;

View file

@ -6,6 +6,7 @@ defmodule Mobilizon.Web.Endpoint do
use Absinthe.Phoenix.Endpoint
plug(Mobilizon.Web.Plugs.SetLocalePlug)
plug(Mobilizon.Web.Plugs.HTTPSecurityPlug)
# For e2e tests
if Application.get_env(:mobilizon, :sql_sandbox) do
@ -75,4 +76,9 @@ defmodule Mobilizon.Web.Endpoint do
)
plug(Mobilizon.Web.Router)
@spec websocket_url :: String.t()
def websocket_url do
String.replace_leading(url(), "http", "ws")
end
end

View file

@ -0,0 +1,116 @@
# Portions of this file are derived from Pleroma:
# Pleroma: A lightweight social networking server
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
@moduledoc """
A plug to setup some HTTP security-related headers, like CSP
"""
alias Mobilizon.Config
import Plug.Conn
require Logger
def init(opts), do: opts
def call(conn, _options) do
if Config.get([:http_security, :enabled]) do
conn
|> merge_resp_headers(headers())
|> maybe_send_sts_header(Config.get([:http_security, :sts]))
else
conn
end
end
defp headers do
referrer_policy = Config.get([:http_security, :referrer_policy])
[
{"referrer-policy", referrer_policy},
{"content-security-policy", csp_string()}
]
end
@static_csp_rules [
"default-src 'none'",
"base-uri 'self'",
"manifest-src 'self'"
]
@csp_start [Enum.join(@static_csp_rules, ";") <> ";"]
defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
static_url = Mobilizon.Web.Endpoint.static_url()
websocket_url = Mobilizon.Web.Endpoint.websocket_url()
img_src =
["img-src 'self' data: blob: "] ++ Config.get([:http_security, :csp_policy, :img_src])
media_src = ["media-src 'self' "] ++ Config.get([:http_security, :csp_policy, :media_src])
connect_src =
["connect-src 'self' blob: ", static_url, ?\s, websocket_url] ++
Config.get([:http_security, :csp_policy, :connect_src])
script_src =
if Config.get(:env) == :dev do
"script-src 'self' 'unsafe-eval' 'unsafe-inline' "
else
"script-src 'self' "
end
script_src = [script_src] ++ Config.get([:http_security, :csp_policy, :script_src])
style_src =
if Config.get(:env) == :dev do
"style-src 'self' 'unsafe-inline' "
else
"style-src 'self' "
end
style_src = [style_src] ++ Config.get([:http_security, :csp_policy, :style_src])
font_src = ["font-src 'self' "] ++ Config.get([:http_security, :csp_policy, :font_src])
frame_src = if Config.get(:env) == :dev, do: "frame-src 'self' ", else: "frame-src 'none' "
frame_src = [frame_src] ++ Config.get([:http_security, :csp_policy, :frame_src])
frame_ancestors =
if Config.get(:env) == :dev, do: "frame-ancestors 'self' ", else: "frame-ancestors 'none' "
frame_ancestors =
[frame_ancestors] ++ Config.get([:http_security, :csp_policy, :frame_ancestors])
insecure = if scheme == "https", do: "upgrade-insecure-requests"
@csp_start
|> add_csp_param(script_src)
|> add_csp_param(style_src)
|> add_csp_param(connect_src)
|> add_csp_param(img_src)
|> add_csp_param(media_src)
|> add_csp_param(font_src)
|> add_csp_param(frame_src)
|> add_csp_param(frame_ancestors)
|> add_csp_param(insecure)
|> :erlang.iolist_to_binary()
end
defp add_csp_param(csp_iodata, nil), do: csp_iodata
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
defp maybe_send_sts_header(conn, true) do
max_age_sts = Config.get([:http_security, :sts_max_age])
merge_resp_headers(conn, [
{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"}
])
end
defp maybe_send_sts_header(conn, _), do: conn
end

View file

@ -4,12 +4,6 @@ defmodule Mobilizon.Web.Router do
"""
use Mobilizon.Web, :router
@csp if Application.fetch_env!(:mobilizon, :env) != :dev,
do: "default-src 'self';",
else:
"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
@headers %{"content-security-policy" => @csp}
pipeline :graphql do
# plug(:accepts, ["json"])
plug(Mobilizon.Web.Auth.Pipeline)
@ -36,7 +30,7 @@ defmodule Mobilizon.Web.Router do
pipeline :activity_pub_and_html do
plug(:accepts, ["html", "activity-json"])
plug(:put_secure_browser_headers, @headers)
plug(:put_secure_browser_headers)
plug(Cldr.Plug.AcceptLanguage,
cldr_backend: Mobilizon.Cldr
@ -44,7 +38,7 @@ defmodule Mobilizon.Web.Router do
end
pipeline :atom_and_ical do
plug(:put_secure_browser_headers, @headers)
plug(:put_secure_browser_headers)
plug(:accepts, ["atom", "ics", "html"])
end
@ -56,7 +50,7 @@ defmodule Mobilizon.Web.Router do
)
plug(:accepts, ["html"])
plug(:put_secure_browser_headers, @headers)
plug(:put_secure_browser_headers)
end
pipeline :remote_media do