From e97206077cad87a325ec724fff3a3596b7408649 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Fri, 4 Nov 2022 09:26:45 +0100 Subject: [PATCH 1/2] Add CSP Policy for pictures Signed-off-by: Thomas Citharel --- lib/service/pictures/provider.ex | 8 ++++++-- lib/service/pictures/unsplash.ex | 12 +++++++++++- lib/web/plugs/http_security_plug.ex | 9 ++++++--- 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/lib/service/pictures/provider.ex b/lib/service/pictures/provider.ex index 87f24508..4ef022bd 100644 --- a/lib/service/pictures/provider.ex +++ b/lib/service/pictures/provider.ex @@ -29,8 +29,12 @@ defmodule Mobilizon.Service.Pictures.Provider do iex> search("London") %Information{url: "https://some_url_to.a/picture.jpeg", author: %{name: "An author", url: "https://url.to/profile"}, source: %{name: "The source name", url: "The source URL" }} """ - @callback search(location :: String.t(), options :: keyword) :: - [Information.t()] + @callback search(location :: String.t(), options :: keyword) :: Information.t() + + @doc """ + The CSP configuration to add for the service to work + """ + @callback csp() :: keyword() @spec endpoint(atom()) :: String.t() def endpoint(provider) do diff --git a/lib/service/pictures/unsplash.ex b/lib/service/pictures/unsplash.ex index 2a6b2f1b..307ef292 100644 --- a/lib/service/pictures/unsplash.ex +++ b/lib/service/pictures/unsplash.ex @@ -16,7 +16,7 @@ defmodule Mobilizon.Service.Pictures.Unsplash do @doc """ Unsplash implementation for `c:Mobilizon.Service.Geospatial.Provider.geocode/3`. """ - @spec search(String.t(), keyword()) :: list(Information.t()) + @spec search(String.t(), keyword()) :: Information.t() def search(location, _options \\ []) do url = "#{unsplash_endpoint()}#{@unsplash_api}?query=#{location}&orientation=landscape" @@ -42,6 +42,16 @@ defmodule Mobilizon.Service.Pictures.Unsplash do end end + @impl Provider + @doc """ + Returns the CSP configuration for this search provider to work + """ + def csp do + :mobilizon + |> Application.get_env(__MODULE__, []) + |> Keyword.get(:csp_policy, []) + end + defp unsplash_app_name do Application.get_env(:mobilizon, __MODULE__) |> get_in([:app_name]) end diff --git a/lib/web/plugs/http_security_plug.ex b/lib/web/plugs/http_security_plug.ex index 082507a2..693b6422 100644 --- a/lib/web/plugs/http_security_plug.ex +++ b/lib/web/plugs/http_security_plug.ex @@ -9,8 +9,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do """ alias Mobilizon.Config - alias Mobilizon.Service.FrontEndAnalytics - alias Mobilizon.Service.GlobalSearch + alias Mobilizon.Service.{FrontEndAnalytics, GlobalSearch, Pictures} import Plug.Conn require Logger @@ -142,7 +141,11 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do config_policy = Keyword.get(options, type, Config.get([:http_security, :csp_policy, type])) front_end_analytics_policy = [Keyword.get(FrontEndAnalytics.csp(), type, [])] global_search_policy = [Keyword.get(GlobalSearch.service().csp(), type, [])] + pictures_policy = [Keyword.get(Pictures.service().csp(), type, [])] - Enum.join(config_policy ++ front_end_analytics_policy ++ global_search_policy, " ") + Enum.join( + config_policy ++ front_end_analytics_policy ++ global_search_policy ++ pictures_policy, + " " + ) end end From 57fac3734753aa77c18f8d486c82511cac35ddfe Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Fri, 4 Nov 2022 10:55:26 +0100 Subject: [PATCH 2/2] Support CSP report_uri, report_to and the Report-To and Reporting-Endpoints headers Signed-off-by: Thomas Citharel --- config/test.exs | 2 ++ lib/web/plugs/http_security_plug.ex | 31 +++++++++++++++++++--- test/web/plugs/http_security_plug_test.exs | 22 ++++++++++++++- 3 files changed, 50 insertions(+), 5 deletions(-) diff --git a/config/test.exs b/config/test.exs index 452c5e06..62901358 100644 --- a/config/test.exs +++ b/config/test.exs @@ -88,6 +88,8 @@ config :mobilizon, Mobilizon.Web.Gettext, allowed_locales: ["fr", "en", "es", "r config :junit_formatter, report_dir: "." +config :mobilizon, :http_security, report_uri: "https://endpoint.com" + if System.get_env("DOCKER", "false") == "false" && File.exists?("./config/test.secret.exs") do import_config "test.secret.exs" end diff --git a/lib/web/plugs/http_security_plug.ex b/lib/web/plugs/http_security_plug.ex index 693b6422..3af248bd 100644 --- a/lib/web/plugs/http_security_plug.ex +++ b/lib/web/plugs/http_security_plug.ex @@ -10,6 +10,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do alias Mobilizon.Config alias Mobilizon.Service.{FrontEndAnalytics, GlobalSearch, Pictures} + alias Mobilizon.Web.Endpoint import Plug.Conn require Logger @@ -33,13 +34,32 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do referrer_policy = Keyword.get(options, :referrer_policy, Config.get([:http_security, :referrer_policy])) - [ + report_uri = Config.get([:http_security, :report_uri]) + + headers = [ {"x-xss-protection", "0"}, {"x-frame-options", "DENY"}, {"x-content-type-options", "nosniff"}, {"referrer-policy", referrer_policy}, {"content-security-policy", csp_string(options)} ] + + if report_uri do + report_group = %{ + "group" => "csp-endpoint", + "max-age" => 10_886_400, + "endpoints" => [ + %{"url" => report_uri} + ] + } + + [ + {"report-to", Jason.encode!(report_group)}, + {"reporting-endpoints", "csp-endpoint=\"#{report_uri}\""} | headers + ] + else + headers + end end @static_csp_rules [ @@ -61,9 +81,10 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do @spec csp_string(Keyword.t()) :: String.t() defp csp_string(options) do - scheme = Keyword.get(options, :scheme, Config.get([Pleroma.Web.Endpoint, :url])[:scheme]) - static_url = Mobilizon.Web.Endpoint.static_url() - websocket_url = Mobilizon.Web.Endpoint.websocket_url() + scheme = Keyword.get(options, :scheme, Config.get([Endpoint, :url])[:scheme]) + static_url = Endpoint.static_url() + websocket_url = Endpoint.websocket_url() + report_uri = Config.get([:http_security, :report_uri]) img_src = [@img_src] ++ [get_csp_config(:img_src, options)] @@ -106,6 +127,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do frame_ancestors = [frame_ancestors] ++ [get_csp_config(:frame_ancestors, options)] + report = if report_uri, do: ["report-uri ", report_uri, " ; report-to csp-endpoint"] insecure = if scheme == "https", do: "upgrade-insecure-requests" @csp_start @@ -118,6 +140,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do |> add_csp_param(frame_src) |> add_csp_param(frame_ancestors) |> add_csp_param(insecure) + |> add_csp_param(report) |> to_string() end diff --git a/test/web/plugs/http_security_plug_test.exs b/test/web/plugs/http_security_plug_test.exs index 43be1dec..e36921fe 100644 --- a/test/web/plugs/http_security_plug_test.exs +++ b/test/web/plugs/http_security_plug_test.exs @@ -49,6 +49,26 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"] end + test "it sends `report-to`, `reporting-endpoints` & `report-uri` CSP response headers", %{ + conn: conn + } do + conn = post(conn, "/api") + + [csp] = Conn.get_resp_header(conn, "content-security-policy") + + assert csp =~ ~r|report-uri https://endpoint.com ; report-to csp-endpoint;| + + [report_to] = Conn.get_resp_header(conn, "report-to") + + assert report_to == + "{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}" + + [reporting_endpoints] = Conn.get_resp_header(conn, "reporting-endpoints") + + assert reporting_endpoints == + "csp-endpoint=\"https://endpoint.com\"" + end + test "default values for content-security-policy are always included", %{conn: conn} do conn = post(conn, "/api") @@ -73,7 +93,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do [csp] = Conn.get_resp_header(conn, "content-security-policy") assert csp =~ - ~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com ;/ + ~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com\s+;/ end end