1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Plugs.HTTPSecurityPlug do
11 def init(opts), do: opts
13 def call(conn, _options) do
14 if Config.get([:http_security, :enabled]) do
16 |> merge_resp_headers(headers())
17 |> maybe_send_sts_header(Config.get([:http_security, :sts]))
24 referrer_policy = Config.get([:http_security, :referrer_policy])
25 report_uri = Config.get([:http_security, :report_uri])
28 {"x-xss-protection", "1; mode=block"},
29 {"x-permitted-cross-domain-policies", "none"},
30 {"x-frame-options", "DENY"},
31 {"x-content-type-options", "nosniff"},
32 {"referrer-policy", referrer_policy},
33 {"x-download-options", "noopen"},
34 {"content-security-policy", csp_string()}
39 "group" => "csp-endpoint",
40 "max-age" => 10_886_400,
42 %{"url" => report_uri}
46 [{"reply-to", Jason.encode!(report_group)} | headers]
55 "frame-ancestors 'none'",
56 "style-src 'self' 'unsafe-inline'",
61 @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
64 scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
65 static_url = Pleroma.Web.Endpoint.static_url()
66 websocket_url = Pleroma.Web.Endpoint.websocket_url()
67 report_uri = Config.get([:http_security, :report_uri])
69 img_src = "img-src 'self' data: blob:"
70 media_src = "media-src 'self'"
72 # Strict multimedia CSP enforcement only when MediaProxy is enabled
73 {img_src, media_src} =
74 if Config.get([:media_proxy, :enabled]) &&
75 !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
76 sources = build_csp_multimedia_source_list()
77 {[img_src, sources], [media_src, sources]}
79 {[img_src, " https:"], [media_src, " https:"]}
82 connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
85 if Pleroma.Config.get(:env) == :dev do
86 [connect_src, " http://localhost:3035/"]
92 if Pleroma.Config.get(:env) == :dev do
93 "script-src 'self' 'unsafe-eval'"
98 report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
99 insecure = if scheme == "https", do: "upgrade-insecure-requests"
102 |> add_csp_param(img_src)
103 |> add_csp_param(media_src)
104 |> add_csp_param(connect_src)
105 |> add_csp_param(script_src)
106 |> add_csp_param(insecure)
107 |> add_csp_param(report)
108 |> :erlang.iolist_to_binary()
111 defp build_csp_multimedia_source_list do
112 media_proxy_whitelist =
113 Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
114 add_source(acc, host)
117 media_proxy_base_url =
118 if Config.get([:media_proxy, :base_url]),
119 do: URI.parse(Config.get([:media_proxy, :base_url])).host
122 if Config.get([Pleroma.Upload, :base_url]),
123 do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host
126 if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
127 do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host
129 captcha_method = Config.get([Pleroma.Captcha, :method])
132 if Config.get([Pleroma.Captcha, :enabled]) &&
133 captcha_method != "Pleroma.Captcha.Native",
134 do: Config.get([captcha_method, :endpoint])
137 |> add_source(media_proxy_base_url)
138 |> add_source(upload_base_url)
139 |> add_source(s3_endpoint)
140 |> add_source(media_proxy_whitelist)
141 |> add_source(captcha_endpoint)
144 defp add_source(iodata, nil), do: iodata
145 defp add_source(iodata, source), do: [[?\s, source] | iodata]
147 defp add_csp_param(csp_iodata, nil), do: csp_iodata
149 defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
151 def warn_if_disabled do
152 unless Config.get([:http_security, :enabled]) do
164 vY. .. .nMMM@MMU. ;1v.
165 i7i ... .#MM@M@C. .....:71i
166 it: .... $MMM@9;.,i;;;i,;tti
167 :t7. ..... 0MMMWv.,iii:::,,;St.
168 .nC. ..... IMMMQ..,::::::,.,czX.
169 .ct: ....... .ZMMMI..,:::::::,,:76Y.
170 c2: ......,i..Y$M@t..:::::::,,..inZY
171 vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
172 i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
173 iIS. ......:ii::..;@MI....,............;Ez.
174 .I9. ......:i::::...8M1..................C0z.
175 .z9; ......:i::::,.. .i:...................zWX.
176 vbv ......,i::::,,. ................. :AQY
177 c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
178 :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
179 :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
180 .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
181 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
182 7C...::::::::::::,,,,.. .................... vSi.
183 ;1;...,,::::::,......... .................. Yz:
185 izAotX7777777777777777777777777777777777777777Y7n92:
186 .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
188 HTTP Security is disabled. Please re-enable it to prevent users from attacking
189 your instance and your users via malicious posts:
191 config :pleroma, :http_security, enabled: true
196 defp maybe_send_sts_header(conn, true) do
197 max_age_sts = Config.get([:http_security, :sts_max_age])
198 max_age_ct = Config.get([:http_security, :ct_max_age])
200 merge_resp_headers(conn, [
201 {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
202 {"expect-ct", "enforce, max-age=#{max_age_ct}"}
206 defp maybe_send_sts_header(conn, _), do: conn