http_security_plug_test.exs
No OneTemporary
Actions

Size

8 KB

Referenced Files

None

Subscribers

None

http_security_plug_test.exs
View Options

	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
	use Pleroma.Web.ConnCase, async: true

	alias Plug.Conn

	import Mox

	setup do
	base_config = Pleroma.Config.get([:http_security])
	%{base_config: base_config}
	end

	defp mock_config(config, additional \\ %{}) do
	Pleroma.StaticStubbedConfigMock
	\|> stub(:get, fn
	[:http_security, key] -> config[key]
	key -> additional[key]
	end)
	end

	describe "http security enabled" do
	setup %{base_config: base_config} do
	%{base_config: Keyword.put(base_config, :enabled, true)}
	end

	test "it does not contain unsafe-eval", %{conn: conn, base_config: base_config} do
	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")
	[header] = Conn.get_resp_header(conn, "content-security-policy")
	refute header =~ ~r/unsafe-eval/
	end

	test "with allow_unsafe_eval set, it does contain it", %{conn: conn, base_config: base_config} do
	base_config =
	base_config
	\|> Keyword.put(:allow_unsafe_eval, true)

	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")
	[header] = Conn.get_resp_header(conn, "content-security-policy")
	assert header =~ ~r/unsafe-eval/
	end

	test "it sends CSP headers when enabled", %{conn: conn, base_config: base_config} do
	mock_config(base_config)
	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "x-xss-protection") == []
	refute Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	refute Conn.get_resp_header(conn, "x-frame-options") == []
	refute Conn.get_resp_header(conn, "x-content-type-options") == []
	refute Conn.get_resp_header(conn, "x-download-options") == []
	refute Conn.get_resp_header(conn, "referrer-policy") == []
	refute Conn.get_resp_header(conn, "content-security-policy") == []
	end

	test "it sends STS headers when enabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:sts, true)
	\|> mock_config()

	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "strict-transport-security") == []
	refute Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "it does not send STS headers when disabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:sts, false)
	\|> mock_config()

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "strict-transport-security") == []
	assert Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "referrer-policy header reflects configured value", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)

	resp = get(conn, "/api/v1/instance")
	assert Conn.get_resp_header(resp, "referrer-policy") == ["same-origin"]

	base_config
	\|> Keyword.put(:referrer_policy, "no-referrer")
	\|> mock_config

	resp = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"]
	end

	test "it sends `report-to` & `report-uri` CSP response headers", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")

	[csp] = Conn.get_resp_header(conn, "content-security-policy")

	assert csp =~ ~r\|report-uri https://endpoint.com;report-to csp-endpoint;\|

	[report_to] = Conn.get_resp_header(conn, "report-to")

	assert report_to ==
	"{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
	end

	test "default values for img-src and media-src with disabled media proxy", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)
	conn = get(conn, "/api/v1/instance")

	[csp] = Conn.get_resp_header(conn, "content-security-policy")
	assert csp =~ "media-src 'self' https:;"
	assert csp =~ "img-src 'self' data: blob: https:;"
	end

	test "it sets the Service-Worker-Allowed header", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:enabled, true)

	additional_config =
	%{}
	\|> Map.put([:frontends, :primary], %{"name" => "fedi-fe", "ref" => "develop"})
	\|> Map.put(
	[:frontends, :available],
	%{
	"fedi-fe" => %{
	"name" => "fedi-fe",
	"custom-http-headers" => [{"service-worker-allowed", "/"}]
	}
	}
	)

	mock_config(base_config, additional_config)
	conn = get(conn, "/api/v1/instance")
	assert Conn.get_resp_header(conn, "service-worker-allowed") == ["/"]
	end
	end

	describe "img-src and media-src" do
	setup %{base_config: base_config} do
	base_config =
	base_config
	\|> Keyword.put(:enabled, true)

	additional_config =
	%{}
	\|> Map.put([:media_proxy, :enabled], true)
	\|> Map.put([:media_proxy, :proxy_opts, :redirect_on_failure], false)
	\|> Map.put([:media_proxy, :whitelist], [])

	%{base_config: base_config, additional_config: additional_config}
	end

	test "media_proxy with base_url", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example.com"

	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :base_url], url)

	mock_config(base_config, additional_config)

	assert_media_img_src(conn, url)
	end

	test "upload with base url", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example2.com"

	additional_config =
	additional_config
	\|> Map.put([Pleroma.Upload, :base_url], url)

	mock_config(base_config, additional_config)

	assert_media_img_src(conn, url)
	end

	test "with S3 public endpoint", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example3.com"

	additional_config =
	additional_config
	\|> Map.put([Pleroma.Uploaders.S3, :public_endpoint], url)

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, url)
	end

	test "with captcha endpoint", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([Pleroma.Captcha.Mock, :endpoint], "https://captcha.com")
	\|> Map.put([Pleroma.Captcha, :method], Pleroma.Captcha.Mock)

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "https://captcha.com")
	end

	test "with media_proxy whitelist", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :whitelist], ["https://example6.com", "https://example7.com"])

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "https://example7.com https://example6.com")
	end

	# TODO: delete after removing support bare domains for media proxy whitelist
	test "with media_proxy bare domains whitelist (deprecated)", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :whitelist], ["example4.com", "example5.com"])

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "example5.com example4.com")
	end
	end

	defp assert_media_img_src(conn, url) do
	conn = get(conn, "/api/v1/instance")
	[csp] = Conn.get_resp_header(conn, "content-security-policy")
	assert csp =~ "media-src 'self' #{url};"
	assert csp =~ "img-src 'self' data: blob: #{url};"
	end

	test "it does not send CSP headers when disabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:enabled, false)
	\|> mock_config

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "x-xss-protection") == []
	assert Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	assert Conn.get_resp_header(conn, "x-frame-options") == []
	assert Conn.get_resp_header(conn, "x-content-type-options") == []
	assert Conn.get_resp_header(conn, "x-download-options") == []
	assert Conn.get_resp_header(conn, "referrer-policy") == []
	assert Conn.get_resp_header(conn, "content-security-policy") == []
	end
	end

File Metadata

Mime Type: text/plain
Expires: Tue, Jan 20, 12:31 PM (1 d, 11 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 973557
Default Alt Text: http_security_plug_test.exs (8 KB)

http_security_plug_test.exsNo OneTemporaryActions

http_security_plug_test.exsView Options

File Metadata

Event Timeline

http_security_plug_test.exs
No OneTemporary
Actions

http_security_plug_test.exs
View Options