Merge branch 'release/2.0.7' into 'stable'

Release/2.0.7

See merge request pleroma/secteam/pleroma!8

CHANGELOG.md

@@ -3,6 +3,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.0.7] - 2020-06-13
+
+### Security
+- Fix potential DoSes exploiting atom leaks in rich media parser and the `UserAllowListPolicy` MRF policy
+
+### Fixed
+- CSP: not allowing images/media from every host when mediaproxy is disabled
+- CSP: not adding mediaproxy base url to image/media hosts
+- StaticFE missing the CSS file
+
+### Upgrade notes
+
+1. Restart Pleroma
+
 ## [2.0.6] - 2020-06-09
 
 ### Security

config/description.exs

@@ -1483,14 +1483,12 @@
   # %{
   #   group: :pleroma,
   #   key: :mrf_user_allowlist,
-  #   type: :group,
+  #   type: :map,
   #   description:
   #     "The keys in this section are the domain names that the policy should apply to." <>
   #       " Each key should be assigned a list of users that should be allowed through by their ActivityPub ID",
-  #   children: [
-  #     ["example.org": ["https://example.org/users/admin"]],
   #     suggestions: [
-  #       ["example.org": ["https://example.org/users/admin"]]
+  #       %{"example.org" => ["https://example.org/users/admin"]}
   #     ]
   #   ]
   # },

docs/configuration/cheatsheet.md

@@ -133,8 +133,9 @@ their ActivityPub ID.
 An example:
 
 ```elixir
-config :pleroma, :mrf_user_allowlist,
+config :pleroma, :mrf_user_allowlist, %{
-  "example.org": ["https://example.org/users/admin"]
+  "example.org" => ["https://example.org/users/admin"]
+}
 ```
 
 #### :mrf_object_age

lib/pleroma/config/deprecation_warnings.ex

@@ -4,9 +4,10 @@
 
 defmodule Pleroma.Config.DeprecationWarnings do
   require Logger
+  alias Pleroma.Config
 
   def check_hellthread_threshold do
-    if Pleroma.Config.get([:mrf_hellthread, :threshold]) do
+    if Config.get([:mrf_hellthread, :threshold]) do
       Logger.warn("""
       !!!DEPRECATION WARNING!!!
       You are using the old configuration mechanism for the hellthread filter. Please check config.md.
@@ -14,7 +15,29 @@ def check_hellthread_threshold do
     end
   end
 
+  def mrf_user_allowlist do
+    config = Config.get(:mrf_user_allowlist)
+
+    if config && Enum.any?(config, fn {k, _} -> is_atom(k) end) do
+      rewritten =
+        Enum.reduce(Config.get(:mrf_user_allowlist), Map.new(), fn {k, v}, acc ->
+          Map.put(acc, to_string(k), v)
+        end)
+
+      Config.put(:mrf_user_allowlist, rewritten)
+
+      Logger.error("""
+      !!!DEPRECATION WARNING!!!
+      As of Pleroma 2.0.7, the `mrf_user_allowlist` setting changed of format.
+      Pleroma 2.1 will remove support for the old format. Please change your configuration to match this:
+
+      config :pleroma, :mrf_user_allowlist, #{inspect(rewritten, pretty: true)}
+      """)
+    end
+  end
+
   def warn do
     check_hellthread_threshold()
+    mrf_user_allowlist()
   end
 end

lib/pleroma/constants.ex

@@ -20,4 +20,9 @@ defmodule Pleroma.Constants do
       "deleted_activity_id"
     ]
   )
+
+  const(static_only_files,
+    do:
+      ~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc)
+  )
 end

lib/pleroma/plugs/http_security_plug.ex

@@ -75,7 +75,7 @@ defp csp_string do
         sources = get_proxy_and_attachment_sources()
         {[img_src, sources], [media_src, sources]}
       else
-        {img_src, media_src}
+        {[img_src, " https:"], [media_src, " https:"]}
       end
 
     connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]
@@ -113,6 +113,10 @@ defp get_proxy_and_attachment_sources do
         add_source(acc, host)
       end)
 
+    media_proxy_base_url =
+      if Config.get([:media_proxy, :base_url]),
+        do: URI.parse(Config.get([:media_proxy, :base_url])).host
+
     upload_base_url =
       if Config.get([Pleroma.Upload, :base_url]),
         do: URI.parse(Config.get([Pleroma.Upload, :base_url])).host
@@ -122,6 +126,7 @@ defp get_proxy_and_attachment_sources do
         do: URI.parse(Config.get([Pleroma.Uploaders.S3, :public_endpoint])).host
 
     []
+    |> add_source(media_proxy_base_url)
     |> add_source(upload_base_url)
     |> add_source(s3_endpoint)
     |> add_source(media_proxy_whitelist)

lib/pleroma/plugs/instance_static.ex

@@ -3,6 +3,8 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Plugs.InstanceStatic do
+  require Pleroma.Constants
+
   @moduledoc """
   This is a shim to call `Plug.Static` but with runtime `from` configuration.
 
@@ -21,9 +23,6 @@ def file_path(path) do
     end
   end
 
-  @only ~w(index.html robots.txt static emoji packs sounds images instance favicon.png sw.js
-  sw-pleroma.js)
-
   def init(opts) do
     opts
     |> Keyword.put(:from, "__unconfigured_instance_static_plug")
@@ -31,7 +30,7 @@ def init(opts) do
     |> Plug.Static.init()
   end
 
-  for only <- @only do
+  for only <- Pleroma.Constants.static_only_files() do
     at = Plug.Router.Utils.split("/")
 
     def call(%{request_path: "/" <> unquote(only) <> _} = conn, opts) do

lib/pleroma/web/activity_pub/mrf/user_allow_list_policy.ex

@@ -24,7 +24,7 @@ def filter(%{"actor" => actor} = object) do
 
     allow_list =
       Config.get(
-        [:mrf_user_allowlist, String.to_atom(actor_info.host)],
+        [:mrf_user_allowlist, actor_info.host],
         []
       )
 

lib/pleroma/web/endpoint.ex

@@ -5,6 +5,8 @@
 defmodule Pleroma.Web.Endpoint do
   use Phoenix.Endpoint, otp_app: :pleroma
 
+  require Pleroma.Constants
+
   socket("/socket", Pleroma.Web.UserSocket)
 
   plug(Pleroma.Plugs.SetLocalePlug)
@@ -34,8 +36,7 @@ defmodule Pleroma.Web.Endpoint do
     Plug.Static,
     at: "/",
     from: :pleroma,
-    only:
+    only: Pleroma.Constants.static_only_files(),
-      ~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc),
     # credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
     gzip: true,
     cache_control_for_etags: @static_cache_control,

lib/pleroma/web/mastodon_api/views/status_view.ex

@@ -307,8 +307,8 @@ def render("card.json", %{rich_media: rich_media, page_url: page_url}) do
     page_url_data = URI.parse(page_url)
 
     page_url_data =
-      if rich_media[:url] != nil do
+      if is_binary(rich_media["url"]) do
-        URI.merge(page_url_data, URI.parse(rich_media[:url]))
+        URI.merge(page_url_data, URI.parse(rich_media["url"]))
       else
         page_url_data
       end
@@ -316,11 +316,9 @@ def render("card.json", %{rich_media: rich_media, page_url: page_url}) do
     page_url = page_url_data |> to_string
 
     image_url =
-      if rich_media[:image] != nil do
+      if is_binary(rich_media["image"]) do
-        URI.merge(page_url_data, URI.parse(rich_media[:image]))
+        URI.merge(page_url_data, URI.parse(rich_media["image"]))
         |> to_string
-      else
-        nil
       end
 
     %{
@@ -329,8 +327,8 @@ def render("card.json", %{rich_media: rich_media, page_url: page_url}) do
       provider_url: page_url_data.scheme <> "://" <> page_url_data.host,
       url: page_url,
       image: image_url |> MediaProxy.url(),
-      title: rich_media[:title] || "",
+      title: rich_media["title"] || "",
-      description: rich_media[:description] || "",
+      description: rich_media["description"] || "",
       pleroma: %{
         opengraph: rich_media
       }

lib/pleroma/web/rich_media/helpers.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.RichMedia.Helpers do
   alias Pleroma.Object
   alias Pleroma.Web.RichMedia.Parser
 
-  @spec validate_page_url(any()) :: :ok | :error
+  @spec validate_page_url(URI.t() | binary()) :: :ok | :error
   defp validate_page_url(page_url) when is_binary(page_url) do
     validate_tld = Application.get_env(:auto_linker, :opts)[:validate_tld]
 
@@ -18,8 +18,8 @@ defp validate_page_url(page_url) when is_binary(page_url) do
     |> parse_uri(page_url)
   end
 
-  defp validate_page_url(%URI{host: host, scheme: scheme, authority: authority})
+  defp validate_page_url(%URI{host: host, scheme: "https", authority: authority})
-       when scheme == "https" and not is_nil(authority) do
+       when is_binary(authority) do
     cond do
       host in Config.get([:rich_media, :ignore_hosts], []) ->
         :error

lib/pleroma/web/rich_media/parser.ex

@@ -83,7 +83,7 @@ defp parse_url(url) do
       html
       |> parse_html()
       |> maybe_parse()
-      |> Map.put(:url, url)
+      |> Map.put("url", url)
       |> clean_parsed_data()
       |> check_parsed_data()
     rescue
@@ -103,8 +103,8 @@ defp maybe_parse(html) do
     end)
   end
 
-  defp check_parsed_data(%{title: title} = data)
+  defp check_parsed_data(%{"title" => title} = data)
-       when is_binary(title) and byte_size(title) > 0 do
+       when is_binary(title) and title != "" do
     {:ok, data}
   end
 
@@ -115,11 +115,7 @@ defp check_parsed_data(data) do
   defp clean_parsed_data(data) do
     data
     |> Enum.reject(fn {key, val} ->
-      with {:ok, _} <- Jason.encode(%{key => val}) do
+      not match?({:ok, _}, Jason.encode(%{key => val}))
-        false
-      else
-        _ -> true
-      end
     end)
     |> Map.new()
   end

lib/pleroma/web/rich_media/parsers/meta_tags_parser.ex

@@ -29,19 +29,19 @@ defp normalize_attributes(html_node, prefix, key_name, value_name) do
     {_tag, attributes, _children} = html_node
 
     data =
-      Enum.into(attributes, %{}, fn {name, value} ->
+      Map.new(attributes, fn {name, value} ->
         {name, String.trim_leading(value, "#{prefix}:")}
       end)
 
-    %{String.to_atom(data[key_name]) => data[value_name]}
+    %{data[key_name] => data[value_name]}
   end
 
-  defp maybe_put_title(%{title: _} = meta, _), do: meta
+  defp maybe_put_title(%{"title" => _} = meta, _), do: meta
 
   defp maybe_put_title(meta, html) when meta != %{} do
     case get_page_title(html) do
       "" -> meta
-      title -> Map.put_new(meta, :title, title)
+      title -> Map.put_new(meta, "title", title)
     end
   end
 

lib/pleroma/web/rich_media/parsers/oembed_parser.ex

@@ -5,7 +5,7 @@
 defmodule Pleroma.Web.RichMedia.Parsers.OEmbed do
   def parse(html, _data) do
     with elements = [_ | _] <- get_discovery_data(html),
-         {:ok, oembed_url} <- get_oembed_url(elements),
+         oembed_url when is_binary(oembed_url) <- get_oembed_url(elements),
          {:ok, oembed_data} <- get_oembed_data(oembed_url) do
       {:ok, oembed_data}
     else
@@ -17,19 +17,13 @@ defp get_discovery_data(html) do
     html |> Floki.find("link[type='application/json+oembed']")
   end
 
-  defp get_oembed_url(nodes) do
+  defp get_oembed_url([{"link", attributes, _children} | _]) do
-    {"link", attributes, _children} = nodes |> hd()
+    Enum.find_value(attributes, fn {k, v} -> if k == "href", do: v end)
-
-    {:ok, Enum.into(attributes, %{})["href"]}
   end
 
   defp get_oembed_data(url) do
-    {:ok, %Tesla.Env{body: json}} = Pleroma.HTTP.get(url, [], adapter: [pool: :media])
+    with {:ok, %Tesla.Env{body: json}} <- Pleroma.HTTP.get(url, [], adapter: [pool: :media]) do
-
+      Jason.decode(json)
-    {:ok, data} = Jason.decode(json)
+    end
-
-    data = data |> Map.new(fn {k, v} -> {String.to_atom(k), v} end)
-
-    {:ok, data}
   end
 end

lib/pleroma/web/templates/layout/static_fe.html.eex

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width,initial-scale=1,minimal-ui" />
     <title><%= Pleroma.Config.get([:instance, :name]) %></title>
     <%= Phoenix.HTML.raw(assigns[:meta] || "") %>
-    <link rel="stylesheet" href="/static/static-fe.css">
+    <link rel="stylesheet" href="/static-fe/static-fe.css">
   </head>
   <body>
     <div class="container">

mix.exs

@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("2.0.6"),
+      version: version("2.0.7"),
       elixir: "~> 1.8",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: [:phoenix, :gettext] ++ Mix.compilers(),

test/web/activity_pub/mrf/user_allowlist_policy_test.exs

@@ -17,14 +17,14 @@ test "pass filter if allow list is empty" do
 
   test "pass filter if allow list isn't empty and user in allow list" do
     actor = insert(:user)
-    Pleroma.Config.put([:mrf_user_allowlist, :localhost], [actor.ap_id, "test-ap-id"])
+    Pleroma.Config.put([:mrf_user_allowlist], %{"localhost" => [actor.ap_id, "test-ap-id"]})
     message = %{"actor" => actor.ap_id}
     assert UserAllowListPolicy.filter(message) == {:ok, message}
   end
 
   test "rejected if allow list isn't empty and user not in allow list" do
     actor = insert(:user)
-    Pleroma.Config.put([:mrf_user_allowlist, :localhost], ["test-ap-id"])
+    Pleroma.Config.put([:mrf_user_allowlist], %{"localhost" => ["test-ap-id"]})
     message = %{"actor" => actor.ap_id}
     assert UserAllowListPolicy.filter(message) == {:reject, nil}
   end

test/web/rich_media/parser_test.exs

@@ -60,19 +60,19 @@ test "returns error when no metadata present" do
   test "doesn't just add a title" do
     assert Pleroma.Web.RichMedia.Parser.parse("http://example.com/non-ogp") ==
              {:error,
-              "Found metadata was invalid or incomplete: %{url: \"http://example.com/non-ogp\"}"}
+              "Found metadata was invalid or incomplete: %{\"url\" => \"http://example.com/non-ogp\"}"}
   end
 
   test "parses ogp" do
     assert Pleroma.Web.RichMedia.Parser.parse("http://example.com/ogp") ==
              {:ok,
               %{
-                image: "http://ia.media-imdb.com/images/rock.jpg",
+                "image" => "http://ia.media-imdb.com/images/rock.jpg",
-                title: "The Rock",
+                "title" => "The Rock",
-                description:
+                "description" =>
                   "Directed by Michael Bay. With Sean Connery, Nicolas Cage, Ed Harris, John Spencer.",
-                type: "video.movie",
+                "type" => "video.movie",
-                url: "http://example.com/ogp"
+                "url" => "http://example.com/ogp"
               }}
   end
 
@@ -80,12 +80,12 @@ test "falls back to <title> when ogp:title is missing" do
     assert Pleroma.Web.RichMedia.Parser.parse("http://example.com/ogp-missing-title") ==
              {:ok,
               %{
-                image: "http://ia.media-imdb.com/images/rock.jpg",
+                "image" => "http://ia.media-imdb.com/images/rock.jpg",
-                title: "The Rock (1996)",
+                "title" => "The Rock (1996)",
-                description:
+                "description" =>
                   "Directed by Michael Bay. With Sean Connery, Nicolas Cage, Ed Harris, John Spencer.",
-                type: "video.movie",
+                "type" => "video.movie",
-                url: "http://example.com/ogp-missing-title"
+                "url" => "http://example.com/ogp-missing-title"
               }}
   end
 
@@ -93,12 +93,12 @@ test "parses twitter card" do
     assert Pleroma.Web.RichMedia.Parser.parse("http://example.com/twitter-card") ==
              {:ok,
               %{
-                card: "summary",
+                "card" => "summary",
-                site: "@flickr",
+                "site" => "@flickr",
-                image: "https://farm6.staticflickr.com/5510/14338202952_93595258ff_z.jpg",
+                "image" => "https://farm6.staticflickr.com/5510/14338202952_93595258ff_z.jpg",
-                title: "Small Island Developing States Photo Submission",
+                "title" => "Small Island Developing States Photo Submission",
-                description: "View the album on Flickr.",
+                "description" => "View the album on Flickr.",
-                url: "http://example.com/twitter-card"
+                "url" => "http://example.com/twitter-card"
               }}
   end
 
@@ -106,27 +106,28 @@ test "parses OEmbed" do
     assert Pleroma.Web.RichMedia.Parser.parse("http://example.com/oembed") ==
              {:ok,
               %{
-                author_name: "‮‭‬bees‬",
+                "author_name" => "‮‭‬bees‬",
-                author_url: "https://www.flickr.com/photos/bees/",
+                "author_url" => "https://www.flickr.com/photos/bees/",
-                cache_age: 3600,
+                "cache_age" => 3600,
-                flickr_type: "photo",
+                "flickr_type" => "photo",
-                height: "768",
+                "height" => "768",
-                html:
+                "html" =>
                   "<a data-flickr-embed=\"true\" href=\"https://www.flickr.com/photos/bees/2362225867/\" title=\"Bacon Lollys by ‮‭‬bees‬, on Flickr\"><img src=\"https://farm4.staticflickr.com/3040/2362225867_4a87ab8baf_b.jpg\" width=\"1024\" height=\"768\" alt=\"Bacon Lollys\"></a><script async src=\"https://embedr.flickr.com/assets/client-code.js\" charset=\"utf-8\"></script>",
-                license: "All Rights Reserved",
+                "license" => "All Rights Reserved",
-                license_id: 0,
+                "license_id" => 0,
-                provider_name: "Flickr",
+                "provider_name" => "Flickr",
-                provider_url: "https://www.flickr.com/",
+                "provider_url" => "https://www.flickr.com/",
-                thumbnail_height: 150,
+                "thumbnail_height" => 150,
-                thumbnail_url: "https://farm4.staticflickr.com/3040/2362225867_4a87ab8baf_q.jpg",
+                "thumbnail_url" =>
-                thumbnail_width: 150,
+                  "https://farm4.staticflickr.com/3040/2362225867_4a87ab8baf_q.jpg",
-                title: "Bacon Lollys",
+                "thumbnail_width" => 150,
-                type: "photo",
+                "title" => "Bacon Lollys",
-                url: "http://example.com/oembed",
+                "type" => "photo",
-                version: "1.0",
+                "url" => "http://example.com/oembed",
-                web_page: "https://www.flickr.com/photos/bees/2362225867/",
+                "version" => "1.0",
-                web_page_short_url: "https://flic.kr/p/4AK2sc",
+                "web_page" => "https://www.flickr.com/photos/bees/2362225867/",
-                width: "1024"
+                "web_page_short_url" => "https://flic.kr/p/4AK2sc",
+                "width" => "1024"
               }}
   end
 

test/web/rich_media/parsers/twitter_card_test.exs

@@ -19,11 +19,11 @@ test "parses twitter card with only name attributes" do
     assert TwitterCard.parse(html, %{}) ==
              {:ok,
               %{
-                "app:id:googleplay": "com.nytimes.android",
+                "app:id:googleplay" => "com.nytimes.android",
-                "app:name:googleplay": "NYTimes",
+                "app:name:googleplay" => "NYTimes",
-                "app:url:googleplay": "nytimes://reader/id/100000006583622",
+                "app:url:googleplay" => "nytimes://reader/id/100000006583622",
-                site: nil,
+                "site" => nil,
-                title:
+                "title" =>
                   "She Was Arrested at 14. Then Her Photo Went to a Facial Recognition Database. - The New York Times"
               }}
   end
@@ -36,15 +36,15 @@ test "parses twitter card with only property attributes" do
     assert TwitterCard.parse(html, %{}) ==
              {:ok,
               %{
-                card: "summary_large_image",
+                "card" => "summary_large_image",
-                description:
+                "description" =>
                   "With little oversight, the N.Y.P.D. has been using powerful surveillance technology on photos of children and teenagers.",
-                image:
+                "image" =>
                   "https://static01.nyt.com/images/2019/08/01/nyregion/01nypd-juveniles-promo/01nypd-juveniles-promo-videoSixteenByNineJumbo1600.jpg",
-                "image:alt": "",
+                "image:alt" => "",
-                title:
+                "title" =>
                   "She Was Arrested at 14. Then Her Photo Went to a Facial Recognition Database.",
-                url:
+                "url" =>
                   "https://www.nytimes.com/2019/08/01/nyregion/nypd-facial-recognition-children-teenagers.html"
               }}
   end
@@ -57,19 +57,19 @@ test "parses twitter card with name & property attributes" do
     assert TwitterCard.parse(html, %{}) ==
              {:ok,
               %{
-                "app:id:googleplay": "com.nytimes.android",
+                "app:id:googleplay" => "com.nytimes.android",
-                "app:name:googleplay": "NYTimes",
+                "app:name:googleplay" => "NYTimes",
-                "app:url:googleplay": "nytimes://reader/id/100000006583622",
+                "app:url:googleplay" => "nytimes://reader/id/100000006583622",
-                card: "summary_large_image",
+                "card" => "summary_large_image",
-                description:
+                "description" =>
                   "With little oversight, the N.Y.P.D. has been using powerful surveillance technology on photos of children and teenagers.",
-                image:
+                "image" =>
                   "https://static01.nyt.com/images/2019/08/01/nyregion/01nypd-juveniles-promo/01nypd-juveniles-promo-videoSixteenByNineJumbo1600.jpg",
-                "image:alt": "",
+                "image:alt" => "",
-                site: nil,
+                "site" => nil,
-                title:
+                "title" =>
                   "She Was Arrested at 14. Then Her Photo Went to a Facial Recognition Database.",
-                url:
+                "url" =>
                   "https://www.nytimes.com/2019/08/01/nyregion/nypd-facial-recognition-children-teenagers.html"
               }}
   end
@@ -86,11 +86,11 @@ test "respect only first title tag on the page" do
     assert TwitterCard.parse(html, %{}) ==
              {:ok,
               %{
-                site: "@atlasobscura",
+                "site" => "@atlasobscura",
-                title:
+                "title" =>
                   "The Missing Grave of Margaret Corbin, Revolutionary War Veteran - Atlas Obscura",
-                card: "summary_large_image",
+                "card" => "summary_large_image",
-                image: image_path
+                "image" => image_path
               }}
   end
 
@@ -102,12 +102,12 @@ test "takes first founded title in html head if there is html markup error" do
     assert TwitterCard.parse(html, %{}) ==
              {:ok,
               %{
-                site: nil,
+                "site" => nil,
-                title:
+                "title" =>
                   "She Was Arrested at 14. Then Her Photo Went to a Facial Recognition Database. - The New York Times",
-                "app:id:googleplay": "com.nytimes.android",
+                "app:id:googleplay" => "com.nytimes.android",
-                "app:name:googleplay": "NYTimes",
+                "app:name:googleplay" => "NYTimes",
-                "app:url:googleplay": "nytimes://reader/id/100000006583622"
+                "app:url:googleplay" => "nytimes://reader/id/100000006583622"
               }}
   end
 end