Refactor CSP config by using Pleroma's HTTPSecurityPlug

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2021-01-25 15:55:52 +01:00
parent c5fd2e185b
commit e0e46a81e3
No known key found for this signature in database
GPG key ID: A061B9DDE0CA0773
4 changed files with 143 additions and 9 deletions

View file

@ -215,6 +215,24 @@ config :mobilizon, :maps,
type: :openstreetmap type: :openstreetmap
] ]
config :mobilizon, :http_security,
enabled: true,
sts: false,
sts_max_age: 31_536_000,
csp_policy: [
script_src: [],
style_src: [],
connect_src: [],
font_src: [],
img_src: ["*.tile.openstreetmap.org"],
manifest_src: [],
media_src: [],
object_src: [],
frame_src: [],
frame_ancestors: []
],
referrer_policy: "same-origin"
config :mobilizon, :anonymous, config :mobilizon, :anonymous,
participation: [ participation: [
allowed: true, allowed: true,

View file

@ -6,6 +6,7 @@ defmodule Mobilizon.Web.Endpoint do
use Absinthe.Phoenix.Endpoint use Absinthe.Phoenix.Endpoint
plug(Mobilizon.Web.Plugs.SetLocalePlug) plug(Mobilizon.Web.Plugs.SetLocalePlug)
plug(Mobilizon.Web.Plugs.HTTPSecurityPlug)
# For e2e tests # For e2e tests
if Application.get_env(:mobilizon, :sql_sandbox) do if Application.get_env(:mobilizon, :sql_sandbox) do
@ -75,4 +76,9 @@ defmodule Mobilizon.Web.Endpoint do
) )
plug(Mobilizon.Web.Router) plug(Mobilizon.Web.Router)
@spec websocket_url :: String.t()
def websocket_url do
String.replace_leading(url(), "http", "ws")
end
end end

View file

@ -0,0 +1,116 @@
# Portions of this file are derived from Pleroma:
# Pleroma: A lightweight social networking server
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
@moduledoc """
A plug to setup some HTTP security-related headers, like CSP
"""
alias Mobilizon.Config
import Plug.Conn
require Logger
def init(opts), do: opts
def call(conn, _options) do
if Config.get([:http_security, :enabled]) do
conn
|> merge_resp_headers(headers())
|> maybe_send_sts_header(Config.get([:http_security, :sts]))
else
conn
end
end
defp headers do
referrer_policy = Config.get([:http_security, :referrer_policy])
[
{"referrer-policy", referrer_policy},
{"content-security-policy", csp_string()}
]
end
@static_csp_rules [
"default-src 'none'",
"base-uri 'self'",
"manifest-src 'self'"
]
@csp_start [Enum.join(@static_csp_rules, ";") <> ";"]
defp csp_string do
scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
static_url = Mobilizon.Web.Endpoint.static_url()
websocket_url = Mobilizon.Web.Endpoint.websocket_url()
img_src =
["img-src 'self' data: blob: "] ++ Config.get([:http_security, :csp_policy, :img_src])
media_src = ["media-src 'self' "] ++ Config.get([:http_security, :csp_policy, :media_src])
connect_src =
["connect-src 'self' blob: ", static_url, ?\s, websocket_url] ++
Config.get([:http_security, :csp_policy, :connect_src])
script_src =
if Config.get(:env) == :dev do
"script-src 'self' 'unsafe-eval' 'unsafe-inline' "
else
"script-src 'self' "
end
script_src = [script_src] ++ Config.get([:http_security, :csp_policy, :script_src])
style_src =
if Config.get(:env) == :dev do
"style-src 'self' 'unsafe-inline' "
else
"style-src 'self' "
end
style_src = [style_src] ++ Config.get([:http_security, :csp_policy, :style_src])
font_src = ["font-src 'self' "] ++ Config.get([:http_security, :csp_policy, :font_src])
frame_src = if Config.get(:env) == :dev, do: "frame-src 'self' ", else: "frame-src 'none' "
frame_src = [frame_src] ++ Config.get([:http_security, :csp_policy, :frame_src])
frame_ancestors =
if Config.get(:env) == :dev, do: "frame-ancestors 'self' ", else: "frame-ancestors 'none' "
frame_ancestors =
[frame_ancestors] ++ Config.get([:http_security, :csp_policy, :frame_ancestors])
insecure = if scheme == "https", do: "upgrade-insecure-requests"
@csp_start
|> add_csp_param(script_src)
|> add_csp_param(style_src)
|> add_csp_param(connect_src)
|> add_csp_param(img_src)
|> add_csp_param(media_src)
|> add_csp_param(font_src)
|> add_csp_param(frame_src)
|> add_csp_param(frame_ancestors)
|> add_csp_param(insecure)
|> :erlang.iolist_to_binary()
end
defp add_csp_param(csp_iodata, nil), do: csp_iodata
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
defp maybe_send_sts_header(conn, true) do
max_age_sts = Config.get([:http_security, :sts_max_age])
merge_resp_headers(conn, [
{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"}
])
end
defp maybe_send_sts_header(conn, _), do: conn
end

View file

@ -4,12 +4,6 @@ defmodule Mobilizon.Web.Router do
""" """
use Mobilizon.Web, :router use Mobilizon.Web, :router
@csp if Application.fetch_env!(:mobilizon, :env) != :dev,
do: "default-src 'self';",
else:
"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
@headers %{"content-security-policy" => @csp}
pipeline :graphql do pipeline :graphql do
# plug(:accepts, ["json"]) # plug(:accepts, ["json"])
plug(Mobilizon.Web.Auth.Pipeline) plug(Mobilizon.Web.Auth.Pipeline)
@ -36,7 +30,7 @@ defmodule Mobilizon.Web.Router do
pipeline :activity_pub_and_html do pipeline :activity_pub_and_html do
plug(:accepts, ["html", "activity-json"]) plug(:accepts, ["html", "activity-json"])
plug(:put_secure_browser_headers, @headers) plug(:put_secure_browser_headers)
plug(Cldr.Plug.AcceptLanguage, plug(Cldr.Plug.AcceptLanguage,
cldr_backend: Mobilizon.Cldr cldr_backend: Mobilizon.Cldr
@ -44,7 +38,7 @@ defmodule Mobilizon.Web.Router do
end end
pipeline :atom_and_ical do pipeline :atom_and_ical do
plug(:put_secure_browser_headers, @headers) plug(:put_secure_browser_headers)
plug(:accepts, ["atom", "ics", "html"]) plug(:accepts, ["atom", "ics", "html"])
end end
@ -56,7 +50,7 @@ defmodule Mobilizon.Web.Router do
) )
plug(:accepts, ["html"]) plug(:accepts, ["html"])
plug(:put_secure_browser_headers, @headers) plug(:put_secure_browser_headers)
end end
pipeline :remote_media do pipeline :remote_media do