[#1940] Applied rate limit for requests with bad `admin_token`. Added doc warnings...

[akkoma] / lib / pleroma / plugs / http_security_plug.ex

diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
index f9aff2faba03e93bdcbfa352d4102278a4471ed4..7d65cf078605f9034bbdfb2fceae9be049c1c48e 100644 (file)
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -49,17 +49,16 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
     end
   end
 
-  @csp_start [
-               "default-src 'none'",
-               "base-uri 'self'",
-               "frame-ancestors 'none'",
-               "style-src 'self' 'unsafe-inline'",
-               "font-src 'self'",
-               "manifest-src 'self'"
-             ]
-             |> Enum.join(";")
-             |> Kernel.<>(";")
-             |> List.wrap()
+  static_csp_rules = [
+    "default-src 'none'",
+    "base-uri 'self'",
+    "frame-ancestors 'none'",
+    "style-src 'self' 'unsafe-inline'",
+    "font-src 'self'",
+    "manifest-src 'self'"
+  ]
+
+  @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
 
   defp csp_string do
     scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
@@ -67,17 +66,30 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
     websocket_url = Pleroma.Web.Endpoint.websocket_url()
     report_uri = Config.get([:http_security, :report_uri])
 
-    connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]
+    img_src = "img-src 'self' data: blob:"
+    media_src = "media-src 'self'"
+
+    # Strict multimedia CSP enforcement only when MediaProxy is enabled
+    {img_src, media_src} =
+      if Config.get([:media_proxy, :enabled]) &&
+           !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
+        sources = build_csp_multimedia_source_list()
+        {[img_src, sources], [media_src, sources]}
+      else
+        {[img_src, " https:"], [media_src, " https:"]}
+      end
+
+    connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
 
     connect_src =
-      if Pleroma.Config.get(:env) == :dev do
-        [connect_src," http://localhost:3035/"]
+      if Config.get(:env) == :dev do
+        [connect_src, " http://localhost:3035/"]
       else
         connect_src
       end
 
     script_src =
-      if Pleroma.Config.get(:env) == :dev do
+      if Config.get(:env) == :dev do
         "script-src 'self' 'unsafe-eval'"
       else
         "script-src 'self'"
@@ -87,8 +99,8 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
     insecure = if scheme == "https", do: "upgrade-insecure-requests"
 
     @csp_start
-    |> add_csp_param("img-src 'self' data: blob: https:")
-    |> add_csp_param("media-src 'self' https:")
+    |> add_csp_param(img_src)
+    |> add_csp_param(media_src)
     |> add_csp_param(connect_src)
     |> add_csp_param(script_src)
     |> add_csp_param(insecure)
@@ -96,10 +108,47 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
     |> :erlang.iolist_to_binary()
   end
 
+  defp build_csp_multimedia_source_list do
+    media_proxy_whitelist =
+      Enum.reduce(Config.get([:media_proxy, :whitelist]), [], fn host, acc ->
+        add_source(acc, host)
+      end)
+
+    media_proxy_base_url = build_csp_param(Config.get([:media_proxy, :base_url]))
+
+    upload_base_url = build_csp_param(Config.get([Pleroma.Upload, :base_url]))
+
+    s3_endpoint = build_csp_param(Config.get([Pleroma.Uploaders.S3, :public_endpoint]))
+
+    captcha_method = Config.get([Pleroma.Captcha, :method])
+
+    captcha_endpoint = build_csp_param(Config.get([captcha_method, :endpoint]))
+
+    []
+    |> add_source(media_proxy_base_url)
+    |> add_source(upload_base_url)
+    |> add_source(s3_endpoint)
+    |> add_source(media_proxy_whitelist)
+    |> add_source(captcha_endpoint)
+  end
+
+  defp add_source(iodata, nil), do: iodata
+  defp add_source(iodata, source), do: [[?\s, source] | iodata]
+
   defp add_csp_param(csp_iodata, nil), do: csp_iodata
 
   defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
 
+  defp build_csp_param(nil), do: nil
+
+  defp build_csp_param(url) when is_binary(url) do
+    %{host: host, scheme: scheme} = URI.parse(url)
+
+    if scheme do
+      [scheme, "://", host]
+    end
+  end
+
   def warn_if_disabled do
     unless Config.get([:http_security, :enabled]) do
       Logger.warn("