sergiotarxz/Pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Ensure all CSP parameters for remote hosts have a scheme

Browse Source
This commit is contained in:
Mark Felder 2020-07-05 10:11:43 -05:00
parent 991bd78dda
commit af612bd006
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/pleroma/plugs/http_security_plug.ex
View File

@ -116,22 +116,22 @@ defp build_csp_multimedia_source_list do
media_proxy_base_url = media_proxy_base_url =
if Config.get([:media_proxy, :base_url]), if Config.get([:media_proxy, :base_url]),
do: URI.parse(Config.get([:media_proxy, :base_url])).host do: build_csp_param(Config.get([:media_proxy, :base_url]))
upload_base_url = upload_base_url =
if Config.get([Pleroma.Upload, :base_url]), if Config.get([Pleroma.Upload, :base_url]),
do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host do: build_csp_param(Config.get([Pleroma.Upload, :base_url]))
s3_endpoint = s3_endpoint =
if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3, if Config.get([Pleroma.Upload, :uploader]) == Pleroma.Uploaders.S3,
do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host do: build_csp_param(Config.get([Pleroma.Uploaders.S3, :public_endpoint]))
captcha_method = Config.get([Pleroma.Captcha, :method]) captcha_method = Config.get([Pleroma.Captcha, :method])
captcha_endpoint = captcha_endpoint =
if Config.get([Pleroma.Captcha, :enabled]) && if Config.get([Pleroma.Captcha, :enabled]) &&
captcha_method != "Pleroma.Captcha.Native", captcha_method != "Pleroma.Captcha.Native",
do: Config.get([captcha_method, :endpoint]) do: build_csp_param(Config.get([captcha_method, :endpoint]))
[] []
|> add_source(media_proxy_base_url) |> add_source(media_proxy_base_url)
@ -148,6 +148,14 @@ defp add_csp_param(csp_iodata, nil), do: csp_iodata
defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata] defp add_csp_param(csp_iodata, param), do: [[param, ?;] | csp_iodata]
defp build_csp_param(url) when is_binary(url) do
%{host: host, scheme: scheme} = URI.parse(url)
if scheme do
scheme <> "://" <> host
end
end
def warn_if_disabled do def warn_if_disabled do
unless Config.get([:http_security, :enabled]) do unless Config.get([:http_security, :enabled]) do
Logger.warn(" Logger.warn("