git.squeep.com Git - akkoma/blob - lib/pleroma/web/plugs/http_security_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
   6   alias Pleroma.Config
   7   import Plug.Conn
   8
   9   require Logger
  10
  11   def init(opts), do: opts
  12
  13   def call(conn, _options) do
  14     if Config.get([:http_security, :enabled]) do
  15       conn
  16       |> merge_resp_headers(headers())
  17       |> maybe_send_sts_header(Config.get([:http_security, :sts]))
  18     else
  19       conn
  20     end
  21   end
  22
  23   defp headers do
  24     referrer_policy = Config.get([:http_security, :referrer_policy])
  25     report_uri = Config.get([:http_security, :report_uri])
  26     service_worker_allowed = Config.get([:http_security, :service_worker_allowed])
  27
  28     headers = [
  29       {"x-xss-protection", "1; mode=block"},
  30       {"x-permitted-cross-domain-policies", "none"},
  31       {"x-frame-options", "DENY"},
  32       {"x-content-type-options", "nosniff"},
  33       {"referrer-policy", referrer_policy},
  34       {"x-download-options", "noopen"},
  35       {"content-security-policy", csp_string()}
  36     ]
  37
  38     headers =
  39       if service_worker_allowed do
  40         [{"service-worker-allowed", service_worker_allowed} | headers]
  41       else
  42         headers
  43       end
  44
  45     if report_uri do
  46       report_group = %{
  47         "group" => "csp-endpoint",
  48         "max-age" => 10_886_400,
  49         "endpoints" => [
  50           %{"url" => report_uri}
  51         ]
  52       }
  53
  54       [{"reply-to", Jason.encode!(report_group)} | headers]
  55     else
  56       headers
  57     end
  58   end
  59
  60   static_csp_rules = [
  61     "default-src 'none'",
  62     "base-uri 'self'",
  63     "frame-ancestors 'none'",
  64     "style-src 'self' 'unsafe-inline'",
  65     "font-src 'self'",
  66     "manifest-src 'self'"
  67   ]
  68
  69   @csp_start [Enum.join(static_csp_rules, ";") <> ";"]
  70
  71   defp csp_string do
  72     scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
  73     static_url = Pleroma.Web.Endpoint.static_url()
  74     websocket_url = Pleroma.Web.Endpoint.websocket_url()
  75     report_uri = Config.get([:http_security, :report_uri])
  76
  77     img_src = "img-src 'self' data: blob:"
  78     media_src = "media-src 'self'"
  79
  80     # Strict multimedia CSP enforcement only when MediaProxy is enabled
  81     {img_src, media_src} =
  82       if Config.get([:media_proxy, :enabled]) &&
  83            !Config.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
  84         sources = build_csp_multimedia_source_list()
  85         {[img_src, sources], [media_src, sources]}
  86       else
  87         {[img_src, " https:"], [media_src, " https:"]}
  88       end
  89
  90     connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
  91
  92     connect_src =
  93       if Config.get(:env) == :dev do
  94         [connect_src, " http://localhost:3035/"]
  95       else
  96         connect_src
  97       end
  98
  99     script_src =
 100       if Config.get(:env) == :dev do
 101         "script-src 'self' 'unsafe-eval'"
 102       else
 103         "script-src 'self'"
 104       end
 105
 106     report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
 107     insecure = if scheme == "https", do: "upgrade-insecure-requests"
 108
 109     @csp_start
 110     |> add_csp_param(img_src)
 111     |> add_csp_param(media_src)
 112     |> add_csp_param(connect_src)
 113     |> add_csp_param(script_src)
 114     |> add_csp_param(insecure)
 115     |> add_csp_param(report)
 116     |> :erlang.iolist_to_binary()
 117   end
 118
 119   defp build_csp_from_whitelist([], acc), do: acc
 120
 121   defp build_csp_from_whitelist([last], acc) do
 122     [build_csp_param_from_whitelist(last) | acc]
 123   end
 124
 125   defp build_csp_from_whitelist([head | tail], acc) do
 126     build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] | acc])
 127   end
 128
 129   # TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
 130   defp build_csp_param_from_whitelist("http" <> _ = url) do
 131     build_csp_param(url)
 132   end
 133
 134   defp build_csp_param_from_whitelist(url), do: url
 135
 136   defp build_csp_multimedia_source_list do
 137     media_proxy_whitelist =
 138       [:media_proxy, :whitelist]
 139       |> Config.get()
 140       |> build_csp_from_whitelist([])
 141
 142     captcha_method = Config.get([Pleroma.Captcha, :method])
 143     captcha_endpoint = Config.get([captcha_method, :endpoint])
 144
 145     base_endpoints =
 146       [
 147         [:media_proxy, :base_url],
 148         [Pleroma.Upload, :base_url],
 149         [Pleroma.Uploaders.S3, :public_endpoint]
 150       ]
 151       |> Enum.map(&Config.get/1)
 152
 153     [captcha_endpoint | base_endpoints]
 154     |> Enum.map(&build_csp_param/1)
 155     |> Enum.reduce([], &add_source(&2, &1))
 156     |> add_source(media_proxy_whitelist)
 157   end
 158
 159   defp add_source(iodata, nil), do: iodata
 160   defp add_source(iodata, []), do: iodata
 161   defp add_source(iodata, source), do: [[?\s, source] | iodata]
 162
 163   defp add_csp_param(csp_iodata, nil), do: csp_iodata
 164
 165   defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
 166
 167   defp build_csp_param(nil), do: nil
 168
 169   defp build_csp_param(url) when is_binary(url) do
 170     %{host: host, scheme: scheme} = URI.parse(url)
 171
 172     if scheme do
 173       [scheme, "://", host]
 174     end
 175   end
 176
 177   def warn_if_disabled do
 178     unless Config.get([:http_security, :enabled]) do
 179       Logger.warn("
 180                                  .i;;;;i.
 181                                iYcviii;vXY:
 182                              .YXi       .i1c.
 183                             .YC.     .    in7.
 184                            .vc.   ......   ;1c.
 185                            i7,   ..        .;1;
 186                           i7,   .. ...      .Y1i
 187                          ,7v     .6MMM@;     .YX,
 188                         .7;.   ..IMMMMMM1     :t7.
 189                        .;Y.     ;$MMMMMM9.     :tc.
 190                        vY.   .. .nMMM@MMU.      ;1v.
 191                       i7i   ...  .#MM@M@C. .....:71i
 192                      it:   ....   $MMM@9;.,i;;;i,;tti
 193                     :t7.  .....   0MMMWv.,iii:::,,;St.
 194                    .nC.   .....   IMMMQ..,::::::,.,czX.
 195                   .ct:   ....... .ZMMMI..,:::::::,,:76Y.
 196                   c2:   ......,i..Y$M@t..:::::::,,..inZY
 197                  vov   ......:ii..c$MBc..,,,,,,,,,,..iI9i
 198                 i9Y   ......iii:..7@MA,..,,,,,,,,,....;AA:
 199                iIS.  ......:ii::..;@MI....,............;Ez.
 200               .I9.  ......:i::::...8M1..................C0z.
 201              .z9;  ......:i::::,.. .i:...................zWX.
 202              vbv  ......,i::::,,.      ................. :AQY
 203             c6Y.  .,...,::::,,..:t0@@QY. ................ :8bi
 204            :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
 205           :6o,  .,,,,..:::,,,..i#MMMMMM#v.................  YW2.
 206          .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
 207          7Uc. .:::,,,,,::,,,,..   i1t;,..................... .UEi
 208          7C...::::::::::::,,,,..        ....................  vSi.
 209          ;1;...,,::::::,.........       ..................    Yz:
 210           v97,.........                                     .voC.
 211            izAotX7777777777777777777777777777777777777777Y7n92:
 212              .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
 213
 214 HTTP Security is disabled. Please re-enable it to prevent users from attacking
 215 your instance and your users via malicious posts:
 216
 217       config :pleroma, :http_security, enabled: true
 218       ")
 219     end
 220   end
 221
 222   defp maybe_send_sts_header(conn, true) do
 223     max_age_sts = Config.get([:http_security, :sts_max_age])
 224     max_age_ct = Config.get([:http_security, :ct_max_age])
 225
 226     merge_resp_headers(conn, [
 227       {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
 228       {"expect-ct", "enforce, max-age=#{max_age_ct}"}
 229     ])
 230   end
 231
 232   defp maybe_send_sts_header(conn, _), do: conn
 233 end