Page MenuHomePhorge
Files F85805874

No OneTemporary
Actions

Size
6 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/3896.add b/changelog.d/3896.add
deleted file mode 100644
index e8fde4c8a..000000000
--- a/changelog.d/3896.add
+++ /dev/null
@@ -1 +0,0 @@
-Validate Host header for Uploads and return a 302 if the base_url has changed
diff --git a/changelog.d/3909.skip b/changelog.d/3909.skip
new file mode 100644
index 000000000..e69de29bb
diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
index 9dd5eb239..8b3bc9acb 100644
--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@@ -1,134 +1,114 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.UploadedMedia do
@moduledoc """
"""
import Plug.Conn
import Pleroma.Web.Gettext
require Logger
alias Pleroma.Web.MediaProxy
@behaviour Plug
# no slashes
@path "media"
@default_cache_control_header "public, max-age=1209600"
def init(_opts) do
static_plug_opts =
[
headers: %{"cache-control" => @default_cache_control_header},
cache_control_for_etags: @default_cache_control_header
]
|> Keyword.put(:from, "__unconfigured_media_plug")
|> Keyword.put(:at, "/__unconfigured_media_plug")
|> Plug.Static.init()
%{static_plug_opts: static_plug_opts}
end
def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
conn =
case fetch_query_params(conn) do
%{query_params: %{"name" => name}} = conn ->
name = String.replace(name, ~s["], ~s[\\"])
put_resp_header(conn, "content-disposition", ~s[inline; filename="#{name}"])
conn ->
conn
end
|> merge_resp_headers([{"content-security-policy", "sandbox"}])
config = Pleroma.Config.get(Pleroma.Upload)
- %{scheme: media_scheme, host: media_host, port: media_port} =
- Pleroma.Upload.base_url() |> URI.parse()
-
- with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
- uploader <- Keyword.fetch!(config, :uploader),
+ with uploader <- Keyword.fetch!(config, :uploader),
proxy_remote = Keyword.get(config, :proxy_remote, false),
{:ok, get_method} <- uploader.get_file(file),
false <- media_is_banned(conn, get_method) do
get_media(conn, get_method, proxy_remote, opts)
else
- {:valid_host, false} ->
- redirect_url =
- %URI{
- scheme: media_scheme,
- host: media_host,
- port: media_port,
- path: conn.request_path,
- query: conn.query_string
- }
- |> URI.to_string()
- |> String.trim_trailing("?")
-
- conn
- |> Phoenix.Controller.redirect(external: redirect_url)
- |> halt()
-
_ ->
conn
|> send_resp(:internal_server_error, dgettext("errors", "Failed"))
|> halt()
end
end
def call(conn, _opts), do: conn
defp media_is_banned(%{request_path: path} = _conn, {:static_dir, _}) do
MediaProxy.in_banned_urls(Pleroma.Upload.base_url() <> path)
end
defp media_is_banned(_, {:url, url}), do: MediaProxy.in_banned_urls(url)
defp media_is_banned(_, _), do: false
defp get_media(conn, {:static_dir, directory}, _, opts) do
static_opts =
Map.get(opts, :static_plug_opts)
|> Map.put(:at, [@path])
|> Map.put(:from, directory)
conn = Plug.Static.call(conn, static_opts)
if conn.halted do
conn
else
conn
|> send_resp(:not_found, dgettext("errors", "Not found"))
|> halt()
end
end
defp get_media(conn, {:url, url}, true, _) do
proxy_opts = [
http: [
follow_redirect: true,
pool: :upload
]
]
conn
|> Pleroma.ReverseProxy.call(url, proxy_opts)
end
defp get_media(conn, {:url, url}, _, _) do
conn
|> Phoenix.Controller.redirect(external: url)
|> halt()
end
defp get_media(conn, unknown, _, _) do
Logger.error("#{__MODULE__}: Unknown get startegy: #{inspect(unknown)}")
conn
|> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
|> halt()
end
end
diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
index dbf8ca5ec..8323ff6ab 100644
--- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs
+++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
@@ -1,69 +1,43 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
use Pleroma.Web.ConnCase, async: true
alias Pleroma.Upload
defp upload_file(context) do
Pleroma.DataCase.ensure_local_uploader(context)
File.cp!("test/fixtures/image.jpg", "test/fixtures/image_tmp.jpg")
file = %Plug.Upload{
content_type: "image/jpeg",
path: Path.absname("test/fixtures/image_tmp.jpg"),
filename: "nice_tf.jpg"
}
{:ok, data} = Upload.store(file)
[%{"href" => attachment_url} | _] = data["url"]
[attachment_url: attachment_url]
end
setup_all :upload_file
test "does not send Content-Disposition header when name param is not set", %{
attachment_url: attachment_url
} do
conn = get(build_conn(), attachment_url)
refute Enum.any?(conn.resp_headers, &(elem(&1, 0) == "content-disposition"))
end
test "sends Content-Disposition header when name param is set", %{
attachment_url: attachment_url
} do
conn = get(build_conn(), attachment_url <> ~s[?name="cofe".gif])
assert Enum.any?(
conn.resp_headers,
&(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]})
)
end
-
- test "denies access to media if wrong Host", %{
- attachment_url: attachment_url
- } do
- conn = get(build_conn(), attachment_url)
-
- assert conn.status == 200
-
- new_media_base = "http://media.localhost:8080"
-
- %{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
- URI.parse(new_media_base)
-
- clear_config([Pleroma.Upload, :base_url], new_media_base)
-
- conn = get(build_conn(), attachment_url)
-
- expected_url =
- URI.parse(attachment_url)
- |> Map.put(:host, new_media_host)
- |> Map.put(:port, new_media_port)
- |> Map.put(:scheme, new_media_scheme)
- |> URI.to_string()
-
- assert redirected_to(conn, 302) == expected_url
- end
end

File Metadata

Mime Type
text/x-diff
Expires
Mon, Oct 12, 7:38 AM (1 d, 21 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1786084
Default Alt Text
(6 KB)

Event Timeline