1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
13 def init(opts), do: opts
15 def call(conn, _options) do
16 if Config.get([:http_security, :enabled]) do
18 |> merge_resp_headers(headers(conn))
19 |> maybe_send_sts_header(Config.get([:http_security, :sts]))
25 def primary_frontend do
26 with %{"name" => frontend} <- Config.get([:frontends, :primary]),
27 available <- Config.get([:frontends, :available]),
28 %{} = primary_frontend <- Map.get(available, frontend) do
29 {:ok, primary_frontend}
33 def custom_http_frontend_headers do
34 with {:ok, %{"custom-http-headers" => custom_headers}} <- primary_frontend() do
41 @spec headers(Plug.Conn.t()) :: [{String.t(), String.t()}]
43 referrer_policy = Config.get([:http_security, :referrer_policy])
44 report_uri = Config.get([:http_security, :report_uri])
45 custom_http_frontend_headers = custom_http_frontend_headers()
48 {"x-xss-protection", "0"},
49 {"x-permitted-cross-domain-policies", "none"},
50 {"x-frame-options", "DENY"},
51 {"x-content-type-options", "nosniff"},
52 {"referrer-policy", referrer_policy},
53 {"content-security-policy", csp_string(conn)},
54 {"permissions-policy", "interest-cohort=()"}
58 if custom_http_frontend_headers do
59 custom_http_frontend_headers ++ headers
66 "group" => "csp-endpoint",
67 "max-age" => 10_886_400,
69 %{"url" => report_uri}
73 [{"report-to", Jason.encode!(report_group)} | headers]
82 "frame-ancestors 'none'",
86 @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
88 defp csp_string(conn) do
89 scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
90 static_url = Pleroma.Web.Endpoint.static_url()
91 websocket_url = Pleroma.Web.Endpoint.websocket_url()
92 report_uri = Config.get([:http_security, :report_uri])
93 %{assigns: %{csp_nonce: nonce}} = conn
94 nonce_tag = "nonce-" <> nonce
95 img_src = "img-src 'self' data: blob:"
96 media_src = "media-src 'self'"
98 # Strict multimedia CSP enforcement only when MediaProxy is enabled
99 {img_src, media_src} =
100 if Config.get([:media_proxy, :enabled]) &&
101 !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
102 sources = build_csp_multimedia_source_list()
103 {[img_src, sources], [media_src, sources]}
105 {[img_src, " https:"], [media_src, " https:"]}
109 if Config.get([:media_proxy, :enabled]) do
110 sources = build_csp_multimedia_source_list()
111 ["connect-src 'self' ", static_url, ?\s, websocket_url, ?\s, sources]
113 ["connect-src 'self' ", static_url, ?\s, websocket_url]
116 style_src = "style-src 'self' '#{nonce_tag}'"
117 font_src = "font-src 'self'"
119 script_src = "script-src 'self' '#{nonce_tag}' "
120 script_src = if @mix_env == :dev do
121 "script-src 'self' 'unsafe-eval' 'unsafe-inline'"
126 report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
127 insecure = if scheme == "https", do: "upgrade-insecure-requests"
130 |> add_csp_param(img_src)
131 |> add_csp_param(media_src)
132 |> add_csp_param(connect_src)
133 |> add_csp_param(script_src)
134 |> add_csp_param(font_src)
135 |> add_csp_param(style_src)
136 |> add_csp_param(insecure)
137 |> add_csp_param(report)
138 |> :erlang.iolist_to_binary()
141 defp build_csp_from_whitelist([], acc), do: acc
143 defp build_csp_from_whitelist([last], acc) do
144 [build_csp_param_from_whitelist(last) | acc]
147 defp build_csp_from_whitelist([head | tail], acc) do
148 build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] | acc])
151 # TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
152 defp build_csp_param_from_whitelist("http" <> _ = url) do
156 defp build_csp_param_from_whitelist(url), do: url
158 defp build_csp_multimedia_source_list do
159 media_proxy_whitelist =
160 [:media_proxy, :whitelist]
162 |> build_csp_from_whitelist([])
164 captcha_method = Config.get([Pleroma.Captcha, :method])
165 captcha_endpoint = Config.get([captcha_method, :endpoint])
169 [:media_proxy, :base_url],
170 [Pleroma.Upload, :base_url],
171 [Pleroma.Uploaders.S3, :public_endpoint]
173 |> Enum.map(&Config.get/1)
175 [captcha_endpoint | base_endpoints]
176 |> Enum.map(&build_csp_param/1)
177 |> Enum.reduce([], &add_source(&2, &1))
178 |> add_source(media_proxy_whitelist)
181 defp add_source(iodata, nil), do: iodata
182 defp add_source(iodata, []), do: iodata
183 defp add_source(iodata, source), do: [[?\s, source] | iodata]
185 defp add_csp_param(csp_iodata, nil), do: csp_iodata
187 defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
189 defp build_csp_param(nil), do: nil
191 defp build_csp_param(url) when is_binary(url) do
192 %{host: host, scheme: scheme} = URI.parse(url)
195 [scheme, "://", host]
199 def warn_if_disabled do
200 unless Config.get([:http_security, :enabled]) do
212 vY. .. .nMMM@MMU. ;1v.
213 i7i ... .#MM@M@C. .....:71i
214 it: .... $MMM@9;.,i;;;i,;tti
215 :t7. ..... 0MMMWv.,iii:::,,;St.
216 .nC. ..... IMMMQ..,::::::,.,czX.
217 .ct: ....... .ZMMMI..,:::::::,,:76Y.
218 c2: ......,i..Y$M@t..:::::::,,..inZY
219 vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
220 i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
221 iIS. ......:ii::..;@MI....,............;Ez.
222 .I9. ......:i::::...8M1..................C0z.
223 .z9; ......:i::::,.. .i:...................zWX.
224 vbv ......,i::::,,. ................. :AQY
225 c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
226 :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
227 :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
228 .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
229 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
230 7C...::::::::::::,,,,.. .................... vSi.
231 ;1;...,,::::::,......... .................. Yz:
233 izAotX7777777777777777777777777777777777777777Y7n92:
234 .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
236 HTTP Security is disabled. Please re-enable it to prevent users from attacking
237 your instance and your users via malicious posts:
239 config :pleroma, :http_security, enabled: true
244 defp maybe_send_sts_header(conn, true) do
245 max_age_sts = Config.get([:http_security, :sts_max_age])
247 merge_resp_headers(conn, [
248 {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains; preload"}
252 defp maybe_send_sts_header(conn, _), do: conn