git.squeep.com Git - akkoma/blob - lib/pleroma/web/plugs/http_security_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
   6   alias Pleroma.Config
   7   import Plug.Conn
   8
   9   require Logger
  10
  11   @mix_env Mix.env()
  12
  13   def init(opts), do: opts
  14
  15   def call(conn, _options) do
  16     if Config.get([:http_security, :enabled]) do
  17       conn
  18       |> merge_resp_headers(headers(conn))
  19       |> maybe_send_sts_header(Config.get([:http_security, :sts]))
  20     else
  21       conn
  22     end
  23   end
  24
  25   def primary_frontend do
  26     with %{"name" => frontend} <- Config.get([:frontends, :primary]),
  27          available <- Config.get([:frontends, :available]),
  28          %{} = primary_frontend <- Map.get(available, frontend) do
  29       {:ok, primary_frontend}
  30     end
  31   end
  32
  33   def custom_http_frontend_headers do
  34     with {:ok, %{"custom-http-headers" => custom_headers}} <- primary_frontend() do
  35       custom_headers
  36     else
  37       _ -> []
  38     end
  39   end
  40
  41   @spec headers(Plug.Conn.t()) :: [{String.t(), String.t()}]
  42   def headers(conn) do
  43     referrer_policy = Config.get([:http_security, :referrer_policy])
  44     report_uri = Config.get([:http_security, :report_uri])
  45     custom_http_frontend_headers = custom_http_frontend_headers()
  46
  47     headers = [
  48       {"x-xss-protection", "0"},
  49       {"x-permitted-cross-domain-policies", "none"},
  50       {"x-frame-options", "DENY"},
  51       {"x-content-type-options", "nosniff"},
  52       {"referrer-policy", referrer_policy},
  53       {"content-security-policy", csp_string(conn)},
  54       {"permissions-policy", "interest-cohort=()"}
  55     ]
  56
  57     headers =
  58       if custom_http_frontend_headers do
  59         custom_http_frontend_headers ++ headers
  60       else
  61         headers
  62       end
  63
  64     if report_uri do
  65       report_group = %{
  66         "group" => "csp-endpoint",
  67         "max-age" => 10_886_400,
  68         "endpoints" => [
  69           %{"url" => report_uri}
  70         ]
  71       }
  72
  73       [{"report-to", Jason.encode!(report_group)} | headers]
  74     else
  75       headers
  76     end
  77   end
  78
  79   static_csp_rules = [
  80     "default-src 'none'",
  81     "base-uri 'none'",
  82     "frame-ancestors 'none'",
  83     "manifest-src 'self'"
  84   ]
  85
  86   @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
  87
  88   defp csp_string(conn) do
  89     scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
  90     static_url = Pleroma.Web.Endpoint.static_url()
  91     websocket_url = Pleroma.Web.Endpoint.websocket_url()
  92     report_uri = Config.get([:http_security, :report_uri])
  93     %{assigns: %{csp_nonce: nonce}} = conn
  94     nonce_tag = "nonce-" <> nonce
  95     img_src = "img-src 'self' data: blob:"
  96     media_src = "media-src 'self'"
  97
  98     # Strict multimedia CSP enforcement only when MediaProxy is enabled
  99     {img_src, media_src} =
 100       if Config.get([:media_proxy, :enabled]) &&
 101            !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
 102         sources = build_csp_multimedia_source_list()
 103         {[img_src, sources], [media_src, sources]}
 104       else
 105         {[img_src, " https:"], [media_src, " https:"]}
 106       end
 107
 108     connect_src =
 109       if Config.get([:media_proxy, :enabled]) do
 110         sources = build_csp_multimedia_source_list()
 111         ["connect-src 'self' ", static_url, ?\s, websocket_url, ?\s, sources]
 112       else
 113         ["connect-src 'self' ", static_url, ?\s, websocket_url]
 114       end
 115
 116     style_src = "style-src 'self' '#{nonce_tag}'"
 117     font_src = "font-src 'self'"
 118
 119     script_src = "script-src 'self' '#{nonce_tag}' "
 120
 121     script_src =
 122       if @mix_env == :dev do
 123         "script-src 'self' 'unsafe-eval' 'unsafe-inline'"
 124       else
 125         script_src
 126       end
 127
 128     report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
 129     insecure = if scheme == "https", do: "upgrade-insecure-requests"
 130
 131     @csp_start
 132     |> add_csp_param(img_src)
 133     |> add_csp_param(media_src)
 134     |> add_csp_param(connect_src)
 135     |> add_csp_param(script_src)
 136     |> add_csp_param(font_src)
 137     |> add_csp_param(style_src)
 138     |> add_csp_param(insecure)
 139     |> add_csp_param(report)
 140     |> :erlang.iolist_to_binary()
 141   end
 142
 143   defp build_csp_from_whitelist([], acc), do: acc
 144
 145   defp build_csp_from_whitelist([last], acc) do
 146     [build_csp_param_from_whitelist(last) | acc]
 147   end
 148
 149   defp build_csp_from_whitelist([head | tail], acc) do
 150     build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] | acc])
 151   end
 152
 153   # TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
 154   defp build_csp_param_from_whitelist("http" <> _ = url) do
 155     build_csp_param(url)
 156   end
 157
 158   defp build_csp_param_from_whitelist(url), do: url
 159
 160   defp build_csp_multimedia_source_list do
 161     media_proxy_whitelist =
 162       [:media_proxy, :whitelist]
 163       |> Config.get()
 164       |> build_csp_from_whitelist([])
 165
 166     captcha_method = Config.get([Pleroma.Captcha, :method])
 167     captcha_endpoint = Config.get([captcha_method, :endpoint])
 168
 169     base_endpoints =
 170       [
 171         [:media_proxy, :base_url],
 172         [Pleroma.Upload, :base_url],
 173         [Pleroma.Uploaders.S3, :public_endpoint]
 174       ]
 175       |> Enum.map(&Config.get/1)
 176
 177     [captcha_endpoint | base_endpoints]
 178     |> Enum.map(&build_csp_param/1)
 179     |> Enum.reduce([], &add_source(&2, &1))
 180     |> add_source(media_proxy_whitelist)
 181   end
 182
 183   defp add_source(iodata, nil), do: iodata
 184   defp add_source(iodata, []), do: iodata
 185   defp add_source(iodata, source), do: [[?\s, source] | iodata]
 186
 187   defp add_csp_param(csp_iodata, nil), do: csp_iodata
 188
 189   defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
 190
 191   defp build_csp_param(nil), do: nil
 192
 193   defp build_csp_param(url) when is_binary(url) do
 194     %{host: host, scheme: scheme} = URI.parse(url)
 195
 196     if scheme do
 197       [scheme, "://", host]
 198     end
 199   end
 200
 201   def warn_if_disabled do
 202     unless Config.get([:http_security, :enabled]) do
 203       Logger.warn("
 204                                  .i;;;;i.
 205                                iYcviii;vXY:
 206                              .YXi       .i1c.
 207                             .YC.     .    in7.
 208                            .vc.   ......   ;1c.
 209                            i7,   ..        .;1;
 210                           i7,   .. ...      .Y1i
 211                          ,7v     .6MMM@;     .YX,
 212                         .7;.   ..IMMMMMM1     :t7.
 213                        .;Y.     ;$MMMMMM9.     :tc.
 214                        vY.   .. .nMMM@MMU.      ;1v.
 215                       i7i   ...  .#MM@M@C. .....:71i
 216                      it:   ....   $MMM@9;.,i;;;i,;tti
 217                     :t7.  .....   0MMMWv.,iii:::,,;St.
 218                    .nC.   .....   IMMMQ..,::::::,.,czX.
 219                   .ct:   ....... .ZMMMI..,:::::::,,:76Y.
 220                   c2:   ......,i..Y$M@t..:::::::,,..inZY
 221                  vov   ......:ii..c$MBc..,,,,,,,,,,..iI9i
 222                 i9Y   ......iii:..7@MA,..,,,,,,,,,....;AA:
 223                iIS.  ......:ii::..;@MI....,............;Ez.
 224               .I9.  ......:i::::...8M1..................C0z.
 225              .z9;  ......:i::::,.. .i:...................zWX.
 226              vbv  ......,i::::,,.      ................. :AQY
 227             c6Y.  .,...,::::,,..:t0@@QY. ................ :8bi
 228            :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
 229           :6o,  .,,,,..:::,,,..i#MMMMMM#v.................  YW2.
 230          .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
 231          7Uc. .:::,,,,,::,,,,..   i1t;,..................... .UEi
 232          7C...::::::::::::,,,,..        ....................  vSi.
 233          ;1;...,,::::::,.........       ..................    Yz:
 234           v97,.........                                     .voC.
 235            izAotX7777777777777777777777777777777777777777Y7n92:
 236              .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
 237
 238 HTTP Security is disabled. Please re-enable it to prevent users from attacking
 239 your instance and your users via malicious posts:
 240
 241       config :pleroma, :http_security, enabled: true
 242       ")
 243     end
 244   end
 245
 246   defp maybe_send_sts_header(conn, true) do
 247     max_age_sts = Config.get([:http_security, :sts_max_age])
 248
 249     merge_resp_headers(conn, [
 250       {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains; preload"}
 251     ])
 252   end
 253
 254   defp maybe_send_sts_header(conn, _), do: conn
 255 end