1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
11 def init(opts), do: opts
13 def call(conn, _options) do
14 if Config.get([:http_security, :enabled]) do
16 |> merge_resp_headers(headers(conn))
17 |> maybe_send_sts_header(Config.get([:http_security, :sts]))
23 def primary_frontend do
24 with %{"name" => frontend} <- Config.get([:frontends, :primary]),
25 available <- Config.get([:frontends, :available]),
26 %{} = primary_frontend <- Map.get(available, frontend) do
27 {:ok, primary_frontend}
31 def custom_http_frontend_headers do
32 with {:ok, %{"custom-http-headers" => custom_headers}} <- primary_frontend() do
39 @spec headers(Plug.Conn.t()) :: [{String.t(), String.t()}]
41 referrer_policy = Config.get([:http_security, :referrer_policy])
42 report_uri = Config.get([:http_security, :report_uri])
43 custom_http_frontend_headers = custom_http_frontend_headers()
46 {"x-xss-protection", "0"},
47 {"x-permitted-cross-domain-policies", "none"},
48 {"x-frame-options", "DENY"},
49 {"x-content-type-options", "nosniff"},
50 {"referrer-policy", referrer_policy},
51 {"content-security-policy", csp_string(conn)},
52 {"permissions-policy", "interest-cohort=()"}
56 if custom_http_frontend_headers do
57 custom_http_frontend_headers ++ headers
64 "group" => "csp-endpoint",
65 "max-age" => 10_886_400,
67 %{"url" => report_uri}
71 [{"report-to", Jason.encode!(report_group)} | headers]
80 "frame-ancestors 'none'",
84 @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
86 defp csp_string(conn) do
87 scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
88 static_url = Pleroma.Web.Endpoint.static_url()
89 websocket_url = Pleroma.Web.Endpoint.websocket_url()
90 report_uri = Config.get([:http_security, :report_uri])
91 %{assigns: %{csp_nonce: nonce}} = conn
92 nonce_tag = "nonce-" <> nonce
93 img_src = "img-src 'self' data: blob:"
94 media_src = "media-src 'self'"
96 # Strict multimedia CSP enforcement only when MediaProxy is enabled
97 {img_src, media_src} =
98 if Config.get([:media_proxy, :enabled]) &&
99 !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
100 sources = build_csp_multimedia_source_list()
101 {[img_src, sources], [media_src, sources]}
103 {[img_src, " https:"], [media_src, " https:"]}
107 if Config.get([:media_proxy, :enabled]) do
108 sources = build_csp_multimedia_source_list()
109 ["connect-src 'self' blob: ", static_url, ?\s, websocket_url, ?\s, sources]
111 ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
114 style_src = "style-src 'self' 'unsafe-inline'"
115 font_src = "font-src 'self' data:"
118 if Config.get(:env) == :dev do
119 "script-src 'self' 'unsafe-eval' '#{nonce_tag}'"
121 "script-src 'self' '#{nonce_tag}'"
124 report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
125 insecure = if scheme == "https", do: "upgrade-insecure-requests"
128 |> add_csp_param(img_src)
129 |> add_csp_param(media_src)
130 |> add_csp_param(connect_src)
131 |> add_csp_param(script_src)
132 |> add_csp_param(font_src)
133 |> add_csp_param(style_src)
134 |> add_csp_param(insecure)
135 |> add_csp_param(report)
136 |> :erlang.iolist_to_binary()
139 defp build_csp_from_whitelist([], acc), do: acc
141 defp build_csp_from_whitelist([last], acc) do
142 [build_csp_param_from_whitelist(last) | acc]
145 defp build_csp_from_whitelist([head | tail], acc) do
146 build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] | acc])
149 # TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
150 defp build_csp_param_from_whitelist("http" <> _ = url) do
154 defp build_csp_param_from_whitelist(url), do: url
156 defp build_csp_multimedia_source_list do
157 media_proxy_whitelist =
158 [:media_proxy, :whitelist]
160 |> build_csp_from_whitelist([])
162 captcha_method = Config.get([Pleroma.Captcha, :method])
163 captcha_endpoint = Config.get([captcha_method, :endpoint])
167 [:media_proxy, :base_url],
168 [Pleroma.Upload, :base_url],
169 [Pleroma.Uploaders.S3, :public_endpoint]
171 |> Enum.map(&Config.get/1)
173 [captcha_endpoint | base_endpoints]
174 |> Enum.map(&build_csp_param/1)
175 |> Enum.reduce([], &add_source(&2, &1))
176 |> add_source(media_proxy_whitelist)
179 defp add_source(iodata, nil), do: iodata
180 defp add_source(iodata, []), do: iodata
181 defp add_source(iodata, source), do: [[?\s, source] | iodata]
183 defp add_csp_param(csp_iodata, nil), do: csp_iodata
185 defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
187 defp build_csp_param(nil), do: nil
189 defp build_csp_param(url) when is_binary(url) do
190 %{host: host, scheme: scheme} = URI.parse(url)
193 [scheme, "://", host]
197 def warn_if_disabled do
198 unless Config.get([:http_security, :enabled]) do
210 vY. .. .nMMM@MMU. ;1v.
211 i7i ... .#MM@M@C. .....:71i
212 it: .... $MMM@9;.,i;;;i,;tti
213 :t7. ..... 0MMMWv.,iii:::,,;St.
214 .nC. ..... IMMMQ..,::::::,.,czX.
215 .ct: ....... .ZMMMI..,:::::::,,:76Y.
216 c2: ......,i..Y$M@t..:::::::,,..inZY
217 vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
218 i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
219 iIS. ......:ii::..;@MI....,............;Ez.
220 .I9. ......:i::::...8M1..................C0z.
221 .z9; ......:i::::,.. .i:...................zWX.
222 vbv ......,i::::,,. ................. :AQY
223 c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
224 :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
225 :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
226 .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
227 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
228 7C...::::::::::::,,,,.. .................... vSi.
229 ;1;...,,::::::,......... .................. Yz:
231 izAotX7777777777777777777777777777777777777777Y7n92:
232 .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
234 HTTP Security is disabled. Please re-enable it to prevent users from attacking
235 your instance and your users via malicious posts:
237 config :pleroma, :http_security, enabled: true
242 defp maybe_send_sts_header(conn, true) do
243 max_age_sts = Config.get([:http_security, :sts_max_age])
245 merge_resp_headers(conn, [
246 {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains; preload"}
250 defp maybe_send_sts_header(conn, _), do: conn