5f36b77d166f217068db5d654ffd175d5dc53e94
[akkoma] / lib / pleroma / web / plugs / http_security_plug.ex
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
6 alias Pleroma.Config
7 import Plug.Conn
8
9 require Logger
10
11 def init(opts), do: opts
12
13 def call(conn, _options) do
14 if Config.get([:http_security, :enabled]) do
15 conn
16 |> merge_resp_headers(headers())
17 |> maybe_send_sts_header(Config.get([:http_security, :sts]))
18 else
19 conn
20 end
21 end
22
23 def primary_frontend do
24 with %{"name" => frontend} <- Config.get([:frontends, :primary]),
25 available <- Config.get([:frontends, :available]),
26 %{} = primary_frontend <- Map.get(available, frontend) do
27 {:ok, primary_frontend}
28 end
29 end
30
31 def custom_http_frontend_headers do
32 with {:ok, %{"custom-http-headers" => custom_headers}} <- primary_frontend() do
33 custom_headers
34 else
35 _ -> []
36 end
37 end
38
39 def headers do
40 referrer_policy = Config.get([:http_security, :referrer_policy])
41 report_uri = Config.get([:http_security, :report_uri])
42 custom_http_frontend_headers = custom_http_frontend_headers()
43
44 headers = [
45 {"x-xss-protection", "0"},
46 {"x-permitted-cross-domain-policies", "none"},
47 {"x-frame-options", "DENY"},
48 {"x-content-type-options", "nosniff"},
49 {"referrer-policy", referrer_policy},
50 {"x-download-options", "noopen"},
51 {"content-security-policy", csp_string()},
52 {"permissions-policy", "interest-cohort=()"}
53 ]
54
55 headers =
56 if custom_http_frontend_headers do
57 custom_http_frontend_headers ++ headers
58 else
59 headers
60 end
61
62 if report_uri do
63 report_group = %{
64 "group" => "csp-endpoint",
65 "max-age" => 10_886_400,
66 "endpoints" => [
67 %{"url" => report_uri}
68 ]
69 }
70
71 [{"report-to", Jason.encode!(report_group)} | headers]
72 else
73 headers
74 end
75 end
76
77 static_csp_rules = [
78 "default-src 'none'",
79 "base-uri 'self'",
80 "frame-ancestors 'none'",
81 "style-src 'self' 'unsafe-inline'",
82 "font-src 'self'",
83 "manifest-src 'self'"
84 ]
85
86 @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
87
88 defp csp_string do
89 scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
90 static_url = Pleroma.Web.Endpoint.static_url()
91 websocket_url = Pleroma.Web.Endpoint.websocket_url()
92 report_uri = Config.get([:http_security, :report_uri])
93
94 img_src = "img-src 'self' data: blob:"
95 media_src = "media-src 'self'"
96
97 # Strict multimedia CSP enforcement only when MediaProxy is enabled
98 {img_src, media_src} =
99 if Config.get([:media_proxy, :enabled]) &&
100 !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
101 sources = build_csp_multimedia_source_list()
102 {[img_src, sources], [media_src, sources]}
103 else
104 {[img_src, " https:"], [media_src, " https:"]}
105 end
106
107 connect_src =
108 if Config.get([:media_proxy, :enabled]) do
109 sources = build_csp_multimedia_source_list()
110 ["connect-src 'self' blob: ", static_url, ?\s, websocket_url, ?\s, sources]
111 else
112 ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
113 end
114
115 script_src =
116 if Config.get(:env) == :dev do
117 "script-src 'self' 'unsafe-eval'"
118 else
119 "script-src 'self'"
120 end
121
122 report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
123 insecure = if scheme == "https", do: "upgrade-insecure-requests"
124
125 @csp_start
126 |> add_csp_param(img_src)
127 |> add_csp_param(media_src)
128 |> add_csp_param(connect_src)
129 |> add_csp_param(script_src)
130 |> add_csp_param(insecure)
131 |> add_csp_param(report)
132 |> :erlang.iolist_to_binary()
133 end
134
135 defp build_csp_from_whitelist([], acc), do: acc
136
137 defp build_csp_from_whitelist([last], acc) do
138 [build_csp_param_from_whitelist(last) | acc]
139 end
140
141 defp build_csp_from_whitelist([head | tail], acc) do
142 build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] | acc])
143 end
144
145 # TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
146 defp build_csp_param_from_whitelist("http" <> _ = url) do
147 build_csp_param(url)
148 end
149
150 defp build_csp_param_from_whitelist(url), do: url
151
152 defp build_csp_multimedia_source_list do
153 media_proxy_whitelist =
154 [:media_proxy, :whitelist]
155 |> Config.get()
156 |> build_csp_from_whitelist([])
157
158 captcha_method = Config.get([Pleroma.Captcha, :method])
159 captcha_endpoint = Config.get([captcha_method, :endpoint])
160
161 base_endpoints =
162 [
163 [:media_proxy, :base_url],
164 [Pleroma.Upload, :base_url],
165 [Pleroma.Uploaders.S3, :public_endpoint]
166 ]
167 |> Enum.map(&Config.get/1)
168
169 [captcha_endpoint | base_endpoints]
170 |> Enum.map(&build_csp_param/1)
171 |> Enum.reduce([], &add_source(&2, &1))
172 |> add_source(media_proxy_whitelist)
173 end
174
175 defp add_source(iodata, nil), do: iodata
176 defp add_source(iodata, []), do: iodata
177 defp add_source(iodata, source), do: [[?\s, source] | iodata]
178
179 defp add_csp_param(csp_iodata, nil), do: csp_iodata
180
181 defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
182
183 defp build_csp_param(nil), do: nil
184
185 defp build_csp_param(url) when is_binary(url) do
186 %{host: host, scheme: scheme} = URI.parse(url)
187
188 if scheme do
189 [scheme, "://", host]
190 end
191 end
192
193 def warn_if_disabled do
194 unless Config.get([:http_security, :enabled]) do
195 Logger.warn("
196 .i;;;;i.
197 iYcviii;vXY:
198 .YXi .i1c.
199 .YC. . in7.
200 .vc. ...... ;1c.
201 i7, .. .;1;
202 i7, .. ... .Y1i
203 ,7v .6MMM@; .YX,
204 .7;. ..IMMMMMM1 :t7.
205 .;Y. ;$MMMMMM9. :tc.
206 vY. .. .nMMM@MMU. ;1v.
207 i7i ... .#MM@M@C. .....:71i
208 it: .... $MMM@9;.,i;;;i,;tti
209 :t7. ..... 0MMMWv.,iii:::,,;St.
210 .nC. ..... IMMMQ..,::::::,.,czX.
211 .ct: ....... .ZMMMI..,:::::::,,:76Y.
212 c2: ......,i..Y$M@t..:::::::,,..inZY
213 vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
214 i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
215 iIS. ......:ii::..;@MI....,............;Ez.
216 .I9. ......:i::::...8M1..................C0z.
217 .z9; ......:i::::,.. .i:...................zWX.
218 vbv ......,i::::,,. ................. :AQY
219 c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
220 :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
221 :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
222 .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
223 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
224 7C...::::::::::::,,,,.. .................... vSi.
225 ;1;...,,::::::,......... .................. Yz:
226 v97,......... .voC.
227 izAotX7777777777777777777777777777777777777777Y7n92:
228 .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
229
230 HTTP Security is disabled. Please re-enable it to prevent users from attacking
231 your instance and your users via malicious posts:
232
233 config :pleroma, :http_security, enabled: true
234 ")
235 end
236 end
237
238 defp maybe_send_sts_header(conn, true) do
239 max_age_sts = Config.get([:http_security, :sts_max_age])
240 max_age_ct = Config.get([:http_security, :ct_max_age])
241
242 merge_resp_headers(conn, [
243 {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
244 {"expect-ct", "enforce, max-age=#{max_age_ct}"}
245 ])
246 end
247
248 defp maybe_send_sts_header(conn, _), do: conn
249 end