da4029391d
IO list, not concatenation
2020-07-06 11:28:08 -05:00
65843d92c4
Simplify the logic
2020-07-06 10:59:41 -05:00
af612bd006
Ensure all CSP parameters for remote hosts have a scheme
2020-07-05 10:11:43 -05:00
e9a28078ad
Rename function and clarify that CSP is only strict with MediaProxy enabled
2020-07-03 17:18:22 -05:00
eaa59daa4c
Add Captcha endpoint to CSP headers when MediaProxy is enabled.
...
Our CSP rules are lax when MediaProxy enabled, but lenient otherwise.
This fixes broken captcha on instances not using MediaProxy.
2020-07-03 17:06:20 -05:00
7f7a1a4676
Check for media proxy base_url, not Upload base_url
2020-06-11 11:05:22 -05:00
99afc7f4e4
HTTP security plug: add media proxy base url host to csp
2020-06-10 20:09:16 +03:00
d23b3701d8
Merge branch 'bugfix/csp-unproxied' into 'develop'
...
http_security_plug.ex: Fix non-proxied media
See merge request pleroma/pleroma!2610
2020-05-29 21:23:49 +00:00
109af93227
Apply suggestion to lib/pleroma/plugs/http_security_plug.ex
2020-05-29 21:15:07 +00:00
d38f28870e
Add blob: to connect-src CSP
2020-05-29 11:08:17 -05:00
da1e31fae3
http_security_plug.ex: Fix non-proxied media
2020-05-29 17:20:09 +02:00
27180611df
HTTP Security plug: make starting csp string generation more readable
2020-05-29 12:32:48 +03:00
29ff6d414b
HTTP security plug: Harden img-src and media-src when MediaProxy is enabled
2020-05-27 21:41:19 +03:00
455a402c8a
HTTP Security plug: rewrite &csp_string/0
...
- Directives are now separated with ";" instead of " ;",
according to https://www.w3.org/TR/CSP2/#policy-parsing
the space is optional
- Use an IO list, which at the end gets converted to a binary as
opposed to ++ing a bunch of arrays with binaries together and joining
them to a string. I doubt it gives any significant real world advantage,
but the code is cleaner and now I can sleep at night.
- The static part of csp is pre-joined to a single binary at compile time.
Same reasoning as the last point.
2020-05-27 21:31:47 +03:00
1bd9749a8f
Let blob: pass CSP
2020-04-26 00:29:42 -05:00
6da6540036
Bump copyright years of files changed after 2020-01-07
...
Done via the following command:
git diff fcd5dd259a
2020-03-02 06:08:45 +01:00
36becd5573
Update http_security_plug.ex
2020-01-30 14:07:41 +00:00
e07e7888d7
Fix credo warning
2020-01-29 18:53:43 +04:00
2bd4d6289b
Make the warning more scarier
2020-01-29 18:43:23 +04:00
6302b40791
Warn if HTTPSecurityPlug is disabled
2020-01-28 19:14:09 +04:00
92213fb87c
Replace Mix.env with Pleroma.Config.get(:env)
...
Mix.env/0 is not availible in release environments such as distillery or
elixir's built-in releases.
2019-06-06 23:59:51 +03:00
aa11fa4864
add report uri and report to
2019-05-16 12:49:40 +07:00
acb04306b6
Standardize construction of websocket URL
...
This follows up on the change made in d747bd98
2019-05-03 11:45:04 +00:00
fc37e5815f
Plugs.HTTPSecurityPlug: Add static_url to CSP's connect-src
...
Closes: https://git.pleroma.social/pleroma/pleroma/merge_requests/469
2019-03-05 01:44:24 +01:00
da4c662af3
Plugs.HTTPSecurityPlug: Add webpacker to connect-src
2019-02-12 22:12:12 +01:00
00e8f0b07d
Plugs.HTTPSecurityPlug: Add unsafe-eval to script-src when in dev mode
...
This is needed to run dev mode mastofe at the same time
2019-02-12 22:12:11 +01:00
ea1058929c
Use url[:scheme] instead of protocol to determine if https is enabled
2019-02-12 00:08:52 +01:00
980b5288ed
update copyright years to 2019
2018-12-31 15:41:47 +00:00
2791ce9a1f
add license boilerplate to pleroma core
2018-12-23 20:56:42 +00:00
074fa790ba
fix compile warnings
2018-12-09 20:50:08 +03:00
04daa0fa44
Plugs.HTTPSecurityPlug: Activate upgrade-insecure-requests only when there is https
...
This fixes running mastofe with MIX_ENV=dev
2018-11-26 21:41:36 +01:00
591b11eafc
Add manifest-src to allow manifest.json
2018-11-26 20:48:24 +01:00
c07464607d
http security: remove form-action from CSP definitions
2018-11-16 17:40:21 +00:00
ee5932a504
http security: allow referrer-policy to be configured
2018-11-12 15:14:46 +00:00
fe67665e19
rename CSPPlug to HTTPSecurityPlug.
2018-11-12 15:08:02 +00:00
Mark Felder