Merge branch 'add-csp-policy-for-pictures' into 'main'

Add CSP Policy for pictures

See merge request framasoft/mobilizon!1318

config/test.exs

@@ -88,6 +88,8 @@ config :mobilizon, Mobilizon.Web.Gettext, allowed_locales: ["fr", "en", "es", "r
 
 config :junit_formatter, report_dir: "."
 
+config :mobilizon, :http_security, report_uri: "https://endpoint.com"
+
 if System.get_env("DOCKER", "false") == "false" && File.exists?("./config/test.secret.exs") do
   import_config "test.secret.exs"
 end

lib/service/pictures/provider.ex

@@ -29,8 +29,12 @@ defmodule Mobilizon.Service.Pictures.Provider do
       iex> search("London")
       %Information{url: "https://some_url_to.a/picture.jpeg", author: %{name: "An author", url: "https://url.to/profile"}, source: %{name: "The source name", url: "The source URL" }}
   """
-  @callback search(location :: String.t(), options :: keyword) ::
+  @callback search(location :: String.t(), options :: keyword) :: Information.t()
-              [Information.t()]
+
+  @doc """
+  The CSP configuration to add for the service to work
+  """
+  @callback csp() :: keyword()
 
   @spec endpoint(atom()) :: String.t()
   def endpoint(provider) do

lib/service/pictures/unsplash.ex

@@ -16,7 +16,7 @@ defmodule Mobilizon.Service.Pictures.Unsplash do
   @doc """
   Unsplash implementation for `c:Mobilizon.Service.Geospatial.Provider.geocode/3`.
   """
-  @spec search(String.t(), keyword()) :: list(Information.t())
+  @spec search(String.t(), keyword()) :: Information.t()
   def search(location, _options \\ []) do
     url = "#{unsplash_endpoint()}#{@unsplash_api}?query=#{location}&orientation=landscape"
 
@@ -42,6 +42,16 @@ defmodule Mobilizon.Service.Pictures.Unsplash do
     end
   end
 
+  @impl Provider
+  @doc """
+  Returns the CSP configuration for this search provider to work
+  """
+  def csp do
+    :mobilizon
+    |> Application.get_env(__MODULE__, [])
+    |> Keyword.get(:csp_policy, [])
+  end
+
   defp unsplash_app_name do
     Application.get_env(:mobilizon, __MODULE__) |> get_in([:app_name])
   end

lib/web/plugs/http_security_plug.ex

@@ -9,8 +9,8 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
   """
 
   alias Mobilizon.Config
-  alias Mobilizon.Service.FrontEndAnalytics
+  alias Mobilizon.Service.{FrontEndAnalytics, GlobalSearch, Pictures}
-  alias Mobilizon.Service.GlobalSearch
+  alias Mobilizon.Web.Endpoint
   import Plug.Conn
 
   require Logger
@@ -34,13 +34,32 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
     referrer_policy =
       Keyword.get(options, :referrer_policy, Config.get([:http_security, :referrer_policy]))
 
-    [
+    report_uri = Config.get([:http_security, :report_uri])
+
+    headers = [
       {"x-xss-protection", "0"},
       {"x-frame-options", "DENY"},
       {"x-content-type-options", "nosniff"},
       {"referrer-policy", referrer_policy},
       {"content-security-policy", csp_string(options)}
     ]
+
+    if report_uri do
+      report_group = %{
+        "group" => "csp-endpoint",
+        "max-age" => 10_886_400,
+        "endpoints" => [
+          %{"url" => report_uri}
+        ]
+      }
+
+      [
+        {"report-to", Jason.encode!(report_group)},
+        {"reporting-endpoints", "csp-endpoint=\"#{report_uri}\""} | headers
+      ]
+    else
+      headers
+    end
   end
 
   @static_csp_rules [
@@ -62,9 +81,10 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
   @spec csp_string(Keyword.t()) :: String.t()
   defp csp_string(options) do
-    scheme = Keyword.get(options, :scheme, Config.get([Pleroma.Web.Endpoint, :url])[:scheme])
+    scheme = Keyword.get(options, :scheme, Config.get([Endpoint, :url])[:scheme])
-    static_url = Mobilizon.Web.Endpoint.static_url()
+    static_url = Endpoint.static_url()
-    websocket_url = Mobilizon.Web.Endpoint.websocket_url()
+    websocket_url = Endpoint.websocket_url()
+    report_uri = Config.get([:http_security, :report_uri])
 
     img_src = [@img_src] ++ [get_csp_config(:img_src, options)]
 
@@ -107,6 +127,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
     frame_ancestors = [frame_ancestors] ++ [get_csp_config(:frame_ancestors, options)]
 
+    report = if report_uri, do: ["report-uri ", report_uri, " ; report-to csp-endpoint"]
     insecure = if scheme == "https", do: "upgrade-insecure-requests"
 
     @csp_start
@@ -119,6 +140,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
     |> add_csp_param(frame_src)
     |> add_csp_param(frame_ancestors)
     |> add_csp_param(insecure)
+    |> add_csp_param(report)
     |> to_string()
   end
 
@@ -142,7 +164,11 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
     config_policy = Keyword.get(options, type, Config.get([:http_security, :csp_policy, type]))
     front_end_analytics_policy = [Keyword.get(FrontEndAnalytics.csp(), type, [])]
     global_search_policy = [Keyword.get(GlobalSearch.service().csp(), type, [])]
+    pictures_policy = [Keyword.get(Pictures.service().csp(), type, [])]
 
-    Enum.join(config_policy ++ front_end_analytics_policy ++ global_search_policy, " ")
+    Enum.join(
+      config_policy ++ front_end_analytics_policy ++ global_search_policy ++ pictures_policy,
+      " "
+    )
   end
 end

test/web/plugs/http_security_plug_test.exs

@@ -49,6 +49,26 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
       assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"]
     end
 
+    test "it sends `report-to`, `reporting-endpoints` & `report-uri` CSP response headers", %{
+      conn: conn
+    } do
+      conn = post(conn, "/api")
+
+      [csp] = Conn.get_resp_header(conn, "content-security-policy")
+
+      assert csp =~ ~r|report-uri https://endpoint.com ; report-to csp-endpoint;|
+
+      [report_to] = Conn.get_resp_header(conn, "report-to")
+
+      assert report_to ==
+               "{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
+
+      [reporting_endpoints] = Conn.get_resp_header(conn, "reporting-endpoints")
+
+      assert reporting_endpoints ==
+               "csp-endpoint=\"https://endpoint.com\""
+    end
+
     test "default values for content-security-policy are always included", %{conn: conn} do
       conn = post(conn, "/api")
 
@@ -73,7 +93,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
       [csp] = Conn.get_resp_header(conn, "content-security-policy")
 
       assert csp =~
-               ~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com  ;/
+               ~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' 'sha256-[\w+\/=]*' example.com matomo.example.com\s+;/
     end
   end