No OneTemporary
Actions

Size

24 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/config/test.exs b/config/test.exs
	index b5c9c6e4a..6c88ad3c6 100644
	--- a/config/test.exs
	+++ b/config/test.exs
	@@ -1,188 +1,188 @@
	import Config

	# We don't run a server during test. If one is required,
	# you can enable the server option below.
	config :pleroma, Pleroma.Web.Endpoint,
	http: [port: 4001],
	url: [port: 4001],
	server: true

	# Disable captha for tests
	config :pleroma, Pleroma.Captcha,
	# It should not be enabled for automatic tests
	enabled: false,
	# A fake captcha service for tests
	method: Pleroma.Captcha.Mock

	# Print only warnings and errors during test
	config :logger, :console,
	level: :warning,
	format: "\n[$level] $message\n"

	config :pleroma, :auth, oauth_consumer_strategies: []

	config :pleroma, Pleroma.Upload,
	filters: [],
	link_name: false,
	default_description: :filename

	config :pleroma, Pleroma.Uploaders.Local, uploads: "test/uploads"

	config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Test, enabled: true

	config :pleroma, :instance,
	email: "admin@example.com",
	notify_email: "noreply@example.com",
	skip_thread_containment: false,
	federating: false,
	external_user_synchronization: false,
	static_dir: "test/instance_static/"

	config :pleroma, :activitypub, sign_object_fetches: false, follow_handshake_timeout: 0

	# Configure your database
	config :pleroma, Pleroma.Repo,
	adapter: Ecto.Adapters.Postgres,
	username: "postgres",
	password: "postgres",
	database: "pleroma_test",
	hostname: System.get_env("DB_HOST") \|\| "localhost",
	port: System.get_env("DB_PORT") \|\| "5432",
	pool: Ecto.Adapters.SQL.Sandbox,
	pool_size: System.schedulers_online() * 2

	config :pleroma, :dangerzone, override_repo_pool_size: true

	# Reduce hash rounds for testing
	config :pleroma, :password, iterations: 1

	config :tesla, adapter: Tesla.Mock

	config :pleroma, :rich_media,
	enabled: false,
	ignore_hosts: [],
	ignore_tld: ["local", "localdomain", "lan"],
	max_body: 2_000_000

	config :pleroma, :instance,
	multi_factor_authentication: [
	totp: [
	# digits 6 or 8
	digits: 6,
	period: 30
	],
	backup_codes: [
	number: 2,
	length: 6
	]
	]

	config :web_push_encryption, :vapid_details,
	subject: "mailto:administrator@example.com",
	public_key:
	"BLH1qVhJItRGCfxgTtONfsOKDc9VRAraXw-3NsmjMngWSh7NxOizN6bkuRA7iLTMPS82PjwJAr3UoK9EC1IFrz4",
	private_key: "_-XZ0iebPrRfZ_o0-IatTdszYa8VCH1yLN-JauK7HHA"

	config :pleroma, Oban, testing: :manual

	config :pleroma, Pleroma.ScheduledActivity,
	daily_user_limit: 2,
	total_user_limit: 3,
	enabled: false

	config :pleroma, :rate_limit, %{}

	config :pleroma, :http_security, report_uri: "https://endpoint.com"

	config :pleroma, :http, send_user_agent: false

	rum_enabled = System.get_env("RUM_ENABLED") == "true"
	config :pleroma, :database, rum_enabled: rum_enabled
	IO.puts("RUM enabled: #{rum_enabled}")

	config :joken, default_signer: "yU8uHKq+yyAkZ11Hx//jcdacWc8yQ1bxAAGrplzB0Zwwjkp35v0RK9SO8WTPr6QZ"

	config :pleroma, Pleroma.ReverseProxy.Client, Pleroma.ReverseProxy.ClientMock

	config :pleroma, :modules, runtime_dir: "test/fixtures/modules"

	config :pleroma, Pleroma.Gun, Pleroma.GunMock

	config :pleroma, Pleroma.Emails.NewUsersDigestEmail, enabled: true

	config :pleroma, Pleroma.Web.Plugs.RemoteIp, enabled: false

	config :pleroma, Pleroma.Web.ApiSpec.CastAndValidate, strict: true

	config :tzdata, :autoupdate, :disabled

	config :pleroma, :mrf, policies: []

	config :pleroma, :pipeline,
	object_validator: Pleroma.Web.ActivityPub.ObjectValidatorMock,
	mrf: Pleroma.Web.ActivityPub.MRFMock,
	activity_pub: Pleroma.Web.ActivityPub.ActivityPubMock,
	side_effects: Pleroma.Web.ActivityPub.SideEffectsMock,
	federator: Pleroma.Web.FederatorMock,
	config: Pleroma.ConfigMock

	config :pleroma, :cachex, provider: Pleroma.CachexMock

	config :pleroma, Pleroma.Web.WebFinger, update_nickname_on_user_fetch: false

	config :pleroma, :side_effects,
	ap_streamer: Pleroma.Web.ActivityPub.ActivityPubMock,
	logger: Pleroma.LoggerMock

	config :pleroma, Pleroma.Search, module: Pleroma.Search.DatabaseSearch

	config :pleroma, Pleroma.Search.Meilisearch, url: "http://127.0.0.1:7700/", private_key: nil

	# Reduce recompilation time
	# https://dashbit.co/blog/speeding-up-re-compilation-of-elixir-projects
	config :phoenix, :plug_init_mode, :runtime

	config :pleroma, :config_impl, Pleroma.UnstubbedConfigMock

	config :pleroma, Pleroma.PromEx, disabled: true

	# Mox definitions. Only read during compile time.
	config :pleroma, Pleroma.User.Backup, config_impl: Pleroma.UnstubbedConfigMock
	config :pleroma, Pleroma.Uploaders.S3, ex_aws_impl: Pleroma.Uploaders.S3.ExAwsMock
	config :pleroma, Pleroma.Uploaders.S3, config_impl: Pleroma.UnstubbedConfigMock
	config :pleroma, Pleroma.Upload, config_impl: Pleroma.UnstubbedConfigMock
	config :pleroma, Pleroma.ScheduledActivity, config_impl: Pleroma.UnstubbedConfigMock
	config :pleroma, Pleroma.Web.RichMedia.Helpers, config_impl: Pleroma.StaticStubbedConfigMock
	config :pleroma, Pleroma.Uploaders.IPFS, config_impl: Pleroma.UnstubbedConfigMock
	-config :pleroma, Pleroma.Web.Plugs.HTTPSecurityPlug, config_impl: Pleroma.UnstubbedConfigMock
	+config :pleroma, Pleroma.Web.Plugs.HTTPSecurityPlug, config_impl: Pleroma.StaticStubbedConfigMock

	peer_module =
	if String.to_integer(System.otp_release()) >= 25 do
	:peer
	else
	:slave
	end

	config :pleroma, Pleroma.Cluster, peer_module: peer_module

	config :pleroma, Pleroma.Application,
	background_migrators: false,
	internal_fetch: false,
	load_custom_modules: false,
	max_restarts: 100,
	streamer_registry: false,
	test_http_pools: true

	config :pleroma, Pleroma.Uploaders.Uploader, timeout: 1_000

	config :pleroma, Pleroma.Emoji.Loader, test_emoji: true

	config :pleroma, Pleroma.Web.RichMedia.Backfill, provider: Pleroma.Web.RichMedia.Backfill

	if File.exists?("./config/test.secret.exs") do
	import_config "test.secret.exs"
	else
	IO.puts(
	"You may want to create test.secret.exs to declare custom database connection parameters."
	)
	end
	diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex
	index a1dc6c02a..38f6c511e 100644
	--- a/lib/pleroma/web/plugs/http_security_plug.ex
	+++ b/lib/pleroma/web/plugs/http_security_plug.ex
	@@ -1,263 +1,263 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
	import Plug.Conn

	require Logger

	@config_impl Application.compile_env(:pleroma, [__MODULE__, :config_impl], Pleroma.Config)

	def init(opts), do: opts

	def call(conn, _options) do
	if @config_impl.get([:http_security, :enabled]) do
	conn
	\|> merge_resp_headers(headers())
	\|> maybe_send_sts_header(@config_impl.get([:http_security, :sts]))
	else
	conn
	end
	end

	def primary_frontend do
	with %{"name" => frontend} <- @config_impl.get([:frontends, :primary]),
	available <- @config_impl.get([:frontends, :available]),
	%{} = primary_frontend <- Map.get(available, frontend) do
	{:ok, primary_frontend}
	end
	end

	def custom_http_frontend_headers do
	with {:ok, %{"custom-http-headers" => custom_headers}} <- primary_frontend() do
	custom_headers
	else
	_ -> []
	end
	end

	def headers do
	referrer_policy = @config_impl.get([:http_security, :referrer_policy])
	report_uri = @config_impl.get([:http_security, :report_uri])
	custom_http_frontend_headers = custom_http_frontend_headers()

	headers = [
	{"x-xss-protection", "1; mode=block"},
	{"x-permitted-cross-domain-policies", "none"},
	{"x-frame-options", "DENY"},
	{"x-content-type-options", "nosniff"},
	{"referrer-policy", referrer_policy},
	{"x-download-options", "noopen"},
	{"content-security-policy", csp_string()},
	{"permissions-policy", "interest-cohort=()"}
	]

	headers =
	if custom_http_frontend_headers do
	custom_http_frontend_headers ++ headers
	else
	headers
	end

	if report_uri do
	report_group = %{
	"group" => "csp-endpoint",
	"max-age" => 10_886_400,
	"endpoints" => [
	%{"url" => report_uri}
	]
	}

	[{"report-to", Jason.encode!(report_group)} \| headers]
	else
	headers
	end
	end

	static_csp_rules = [
	"default-src 'none'",
	"base-uri 'self'",
	"frame-ancestors 'none'",
	"style-src 'self' 'unsafe-inline'",
	"font-src 'self'",
	"manifest-src 'self'"
	]

	@csp_start [Enum.join(static_csp_rules, ";") <> ";"]

	defp csp_string do
	scheme = @config_impl.get([Pleroma.Web.Endpoint, :url])[:scheme]
	static_url = Pleroma.Web.Endpoint.static_url()
	websocket_url = Pleroma.Web.Endpoint.websocket_url()
	report_uri = @config_impl.get([:http_security, :report_uri])

	img_src = "img-src 'self' data: blob:"
	media_src = "media-src 'self'"
	connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]

	# Strict multimedia CSP enforcement only when MediaProxy is enabled
	{img_src, media_src, connect_src} =
	if @config_impl.get([:media_proxy, :enabled]) &&
	!@config_impl.get([:media_proxy, :proxy_opts, :redirect_on_failure]) do
	sources = build_csp_multimedia_source_list()

	{
	[img_src, sources],
	[media_src, sources],
	[connect_src, sources]
	}
	else
	{
	[img_src, " https:"],
	[media_src, " https:"],
	[connect_src, " https:"]
	}
	end

	connect_src =
	- if @config_impl.get(:env) == :dev do
	+ if @config_impl.get([:env]) == :dev do
	[connect_src, " http://localhost:3035/"]
	else
	connect_src
	end

	script_src =
	if @config_impl.get([:http_security, :allow_unsafe_eval]) do
	- if @config_impl.get(:env) == :dev do
	+ if @config_impl.get([:env]) == :dev do
	"script-src 'self' 'unsafe-eval'"
	else
	"script-src 'self' 'wasm-unsafe-eval'"
	end
	else
	"script-src 'self'"
	end

	report = if report_uri, do: ["report-uri ", report_uri, ";report-to csp-endpoint"]
	insecure = if scheme == "https", do: "upgrade-insecure-requests"

	@csp_start
	\|> add_csp_param(img_src)
	\|> add_csp_param(media_src)
	\|> add_csp_param(connect_src)
	\|> add_csp_param(script_src)
	\|> add_csp_param(insecure)
	\|> add_csp_param(report)
	\|> :erlang.iolist_to_binary()
	end

	defp build_csp_from_whitelist([], acc), do: acc

	defp build_csp_from_whitelist([last], acc) do
	[build_csp_param_from_whitelist(last) \| acc]
	end

	defp build_csp_from_whitelist([head \| tail], acc) do
	build_csp_from_whitelist(tail, [[?\s, build_csp_param_from_whitelist(head)] \| acc])
	end

	# TODO: use `build_csp_param/1` after removing support bare domains for media proxy whitelist
	defp build_csp_param_from_whitelist("http" <> _ = url) do
	build_csp_param(url)
	end

	defp build_csp_param_from_whitelist(url), do: url

	defp build_csp_multimedia_source_list do
	media_proxy_whitelist =
	[:media_proxy, :whitelist]
	\|> @config_impl.get()
	\|> build_csp_from_whitelist([])

	captcha_method = @config_impl.get([Pleroma.Captcha, :method])
	captcha_endpoint = @config_impl.get([captcha_method, :endpoint])

	base_endpoints =
	[
	[:media_proxy, :base_url],
	[Pleroma.Upload, :base_url],
	[Pleroma.Uploaders.S3, :public_endpoint]
	]
	\|> Enum.map(&@config_impl.get/1)

	[captcha_endpoint \| base_endpoints]
	\|> Enum.map(&build_csp_param/1)
	\|> Enum.reduce([], &add_source(&2, &1))
	\|> add_source(media_proxy_whitelist)
	end

	defp add_source(iodata, nil), do: iodata
	defp add_source(iodata, []), do: iodata
	defp add_source(iodata, source), do: [[?\s, source] \| iodata]

	defp add_csp_param(csp_iodata, nil), do: csp_iodata

	defp add_csp_param(csp_iodata, param), do: [[param, ?;] \| csp_iodata]

	defp build_csp_param(nil), do: nil

	defp build_csp_param(url) when is_binary(url) do
	%{host: host, scheme: scheme} = URI.parse(url)

	if scheme do
	[scheme, "://", host]
	end
	end

	def warn_if_disabled do
	unless Pleroma.Config.get([:http_security, :enabled]) do
	Logger.warning("
	.i;;;;i.
	iYcviii;vXY:
	.YXi .i1c.
	.YC. . in7.
	.vc. ...... ;1c.
	i7, .. .;1;
	i7, .. ... .Y1i
	,7v .6MMM@; .YX,
	.7;. ..IMMMMMM1 :t7.
	.;Y. ;$MMMMMM9. :tc.
	vY. .. .nMMM@MMU. ;1v.
	i7i ... .#MM@M@C. .....:71i
	it: .... $MMM@9;.,i;;;i,;tti
	:t7. ..... 0MMMWv.,iii:::,,;St.
	.nC. ..... IMMMQ..,::::::,.,czX.
	.ct: ....... .ZMMMI..,:::::::,,:76Y.
	c2: ......,i..Y$M@t..:::::::,,..inZY
	vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
	i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
	iIS. ......:ii::..;@MI....,............;Ez.
	.I9. ......:i::::...8M1..................C0z.
	.z9; ......:i::::,.. .i:...................zWX.
	vbv ......,i::::,,. ................. :AQY
	c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
	:6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
	:6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
	.n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
	7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
	7C...::::::::::::,,,,.. .................... vSi.
	;1;...,,::::::,......... .................. Yz:
	v97,......... .voC.
	izAotX7777777777777777777777777777777777777777Y7n92:
	.;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.

	HTTP Security is disabled. Please re-enable it to prevent users from attacking
	your instance and your users via malicious posts:

	config :pleroma, :http_security, enabled: true
	")
	end
	end

	defp maybe_send_sts_header(conn, true) do
	max_age_sts = @config_impl.get([:http_security, :sts_max_age])
	max_age_ct = @config_impl.get([:http_security, :ct_max_age])

	merge_resp_headers(conn, [
	{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
	{"expect-ct", "enforce, max-age=#{max_age_ct}"}
	])
	end

	defp maybe_send_sts_header(conn, _), do: conn
	end
	diff --git a/test/pleroma/web/plugs/http_security_plug_test.exs b/test/pleroma/web/plugs/http_security_plug_test.exs
	index 80ad1fa7d..11a351a41 100644
	--- a/test/pleroma/web/plugs/http_security_plug_test.exs
	+++ b/test/pleroma/web/plugs/http_security_plug_test.exs
	@@ -1,282 +1,282 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
	use Pleroma.Web.ConnCase, async: true

	alias Plug.Conn

	import Mox

	setup do
	base_config = Pleroma.Config.get([:http_security])
	%{base_config: base_config}
	end

	defp mock_config(config, additional \\ %{}) do
	- Pleroma.UnstubbedConfigMock
	+ Pleroma.StaticStubbedConfigMock
	\|> stub(:get, fn
	[:http_security, key] -> config[key]
	key -> additional[key]
	end)
	end

	describe "http security enabled" do
	setup %{base_config: base_config} do
	%{base_config: Keyword.put(base_config, :enabled, true)}
	end

	test "it does not contain unsafe-eval", %{conn: conn, base_config: base_config} do
	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")
	[header] = Conn.get_resp_header(conn, "content-security-policy")
	refute header =~ ~r/unsafe-eval/
	end

	test "with allow_unsafe_eval set, it does contain it", %{conn: conn, base_config: base_config} do
	base_config =
	base_config
	\|> Keyword.put(:allow_unsafe_eval, true)

	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")
	[header] = Conn.get_resp_header(conn, "content-security-policy")
	assert header =~ ~r/unsafe-eval/
	end

	test "it sends CSP headers when enabled", %{conn: conn, base_config: base_config} do
	mock_config(base_config)
	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "x-xss-protection") == []
	refute Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	refute Conn.get_resp_header(conn, "x-frame-options") == []
	refute Conn.get_resp_header(conn, "x-content-type-options") == []
	refute Conn.get_resp_header(conn, "x-download-options") == []
	refute Conn.get_resp_header(conn, "referrer-policy") == []
	refute Conn.get_resp_header(conn, "content-security-policy") == []
	end

	test "it sends STS headers when enabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:sts, true)
	\|> mock_config()

	conn = get(conn, "/api/v1/instance")

	refute Conn.get_resp_header(conn, "strict-transport-security") == []
	refute Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "it does not send STS headers when disabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:sts, false)
	\|> mock_config()

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "strict-transport-security") == []
	assert Conn.get_resp_header(conn, "expect-ct") == []
	end

	test "referrer-policy header reflects configured value", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)

	resp = get(conn, "/api/v1/instance")
	assert Conn.get_resp_header(resp, "referrer-policy") == ["same-origin"]

	base_config
	\|> Keyword.put(:referrer_policy, "no-referrer")
	\|> mock_config

	resp = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"]
	end

	test "it sends `report-to` & `report-uri` CSP response headers", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)

	conn = get(conn, "/api/v1/instance")

	[csp] = Conn.get_resp_header(conn, "content-security-policy")

	assert csp =~ ~r\|report-uri https://endpoint.com;report-to csp-endpoint;\|

	[report_to] = Conn.get_resp_header(conn, "report-to")

	assert report_to ==
	"{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
	end

	test "default values for img-src and media-src with disabled media proxy", %{
	conn: conn,
	base_config: base_config
	} do
	mock_config(base_config)
	conn = get(conn, "/api/v1/instance")

	[csp] = Conn.get_resp_header(conn, "content-security-policy")
	assert csp =~ "media-src 'self' https:;"
	assert csp =~ "img-src 'self' data: blob: https:;"
	end

	test "it sets the Service-Worker-Allowed header", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:enabled, true)

	additional_config =
	%{}
	\|> Map.put([:frontends, :primary], %{"name" => "fedi-fe", "ref" => "develop"})
	\|> Map.put(
	[:frontends, :available],
	%{
	"fedi-fe" => %{
	"name" => "fedi-fe",
	"custom-http-headers" => [{"service-worker-allowed", "/"}]
	}
	}
	)

	mock_config(base_config, additional_config)
	conn = get(conn, "/api/v1/instance")
	assert Conn.get_resp_header(conn, "service-worker-allowed") == ["/"]
	end
	end

	describe "img-src and media-src" do
	setup %{base_config: base_config} do
	base_config =
	base_config
	\|> Keyword.put(:enabled, true)

	additional_config =
	%{}
	\|> Map.put([:media_proxy, :enabled], true)
	\|> Map.put([:media_proxy, :proxy_opts, :redirect_on_failure], false)
	\|> Map.put([:media_proxy, :whitelist], [])

	%{base_config: base_config, additional_config: additional_config}
	end

	test "media_proxy with base_url", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example.com"

	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :base_url], url)

	mock_config(base_config, additional_config)

	assert_media_img_src(conn, url)
	end

	test "upload with base url", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example2.com"

	additional_config =
	additional_config
	\|> Map.put([Pleroma.Upload, :base_url], url)

	mock_config(base_config, additional_config)

	assert_media_img_src(conn, url)
	end

	test "with S3 public endpoint", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	url = "https://example3.com"

	additional_config =
	additional_config
	\|> Map.put([Pleroma.Uploaders.S3, :public_endpoint], url)

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, url)
	end

	test "with captcha endpoint", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([Pleroma.Captcha.Mock, :endpoint], "https://captcha.com")
	\|> Map.put([Pleroma.Captcha, :method], Pleroma.Captcha.Mock)

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "https://captcha.com")
	end

	test "with media_proxy whitelist", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :whitelist], ["https://example6.com", "https://example7.com"])

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "https://example7.com https://example6.com")
	end

	# TODO: delete after removing support bare domains for media proxy whitelist
	test "with media_proxy bare domains whitelist (deprecated)", %{
	conn: conn,
	base_config: base_config,
	additional_config: additional_config
	} do
	additional_config =
	additional_config
	\|> Map.put([:media_proxy, :whitelist], ["example4.com", "example5.com"])

	mock_config(base_config, additional_config)
	assert_media_img_src(conn, "example5.com example4.com")
	end
	end

	defp assert_media_img_src(conn, url) do
	conn = get(conn, "/api/v1/instance")
	[csp] = Conn.get_resp_header(conn, "content-security-policy")
	assert csp =~ "media-src 'self' #{url};"
	assert csp =~ "img-src 'self' data: blob: #{url};"
	end

	test "it does not send CSP headers when disabled", %{conn: conn, base_config: base_config} do
	base_config
	\|> Keyword.put(:enabled, false)
	\|> mock_config

	conn = get(conn, "/api/v1/instance")

	assert Conn.get_resp_header(conn, "x-xss-protection") == []
	assert Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
	assert Conn.get_resp_header(conn, "x-frame-options") == []
	assert Conn.get_resp_header(conn, "x-content-type-options") == []
	assert Conn.get_resp_header(conn, "x-download-options") == []
	assert Conn.get_resp_header(conn, "referrer-policy") == []
	assert Conn.get_resp_header(conn, "content-security-policy") == []
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 9, 9:59 AM (1 d, 20 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1784671
Default Alt Text: (24 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions