No OneTemporary
Actions

Size

24 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/media_proxy/media_proxy.ex b/lib/pleroma/web/media_proxy/media_proxy.ex
	index dd8888a02..a661e9bb7 100644
	--- a/lib/pleroma/web/media_proxy/media_proxy.ex
	+++ b/lib/pleroma/web/media_proxy/media_proxy.ex
	@@ -1,70 +1,73 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MediaProxy do
	- @base64_opts [padding: false]
	-
	- def url(nil), do: nil
	+ alias Pleroma.Config
	+ alias Pleroma.Web

	- def url(""), do: nil
	+ @base64_opts [padding: false]

	+ def url(url) when is_nil(url) or url == "", do: nil
	def url("/" <> _ = url), do: url

	def url(url) do
	- if !enabled?() or local?(url) or whitelisted?(url) do
	+ if disabled?() or local?(url) or whitelisted?(url) do
	url
	else
	encode_url(url)
	end
	end

	- defp enabled?, do: Pleroma.Config.get([:media_proxy, :enabled], false)
	+ defp disabled?, do: !Config.get([:media_proxy, :enabled], false)

	defp local?(url), do: String.starts_with?(url, Pleroma.Web.base_url())

	defp whitelisted?(url) do
	%{host: domain} = URI.parse(url)

	- Enum.any?(Pleroma.Config.get([:media_proxy, :whitelist]), fn pattern ->
	+ Enum.any?(Config.get([:media_proxy, :whitelist]), fn pattern ->
	String.equivalent?(domain, pattern)
	end)
	end

	def encode_url(url) do
	- secret = Pleroma.Config.get([Pleroma.Web.Endpoint, :secret_key_base])
	base64 = Base.url_encode64(url, @base64_opts)
	- sig = :crypto.hmac(:sha, secret, base64)
	- sig64 = sig \|> Base.url_encode64(@base64_opts)
	+
	+ sig64 =
	+ base64
	+ \|> signed_url
	+ \|> Base.url_encode64(@base64_opts)

	build_url(sig64, base64, filename(url))
	end

	def decode_url(sig, url) do
	- secret = Pleroma.Config.get([Pleroma.Web.Endpoint, :secret_key_base])
	- sig = Base.url_decode64!(sig, @base64_opts)
	- local_sig = :crypto.hmac(:sha, secret, url)
	-
	- if local_sig == sig do
	+ with {:ok, sig} <- Base.url_decode64(sig, @base64_opts),
	+ signature when signature == sig <- signed_url(url) do
	{:ok, Base.url_decode64!(url, @base64_opts)}
	else
	- {:error, :invalid_signature}
	+ _ -> {:error, :invalid_signature}
	end
	end

	+ defp signed_url(url) do
	+ :crypto.hmac(:sha, Config.get([Web.Endpoint, :secret_key_base]), url)
	+ end
	+
	def filename(url_or_path) do
	if path = URI.parse(url_or_path).path, do: Path.basename(path)
	end

	def build_url(sig_base64, url_base64, filename \\ nil) do
	[
	- Pleroma.Config.get([:media_proxy, :base_url], Pleroma.Web.base_url()),
	+ Pleroma.Config.get([:media_proxy, :base_url], Web.base_url()),
	"proxy",
	sig_base64,
	url_base64,
	filename
	]
	- \|> Enum.filter(fn value -> value end)
	+ \|> Enum.filter(& &1)
	\|> Path.join()
	end
	end
	diff --git a/lib/pleroma/web/media_proxy/controller.ex b/lib/pleroma/web/media_proxy/media_proxy_controller.ex
	similarity index 80%
	rename from lib/pleroma/web/media_proxy/controller.ex
	rename to lib/pleroma/web/media_proxy/media_proxy_controller.ex
	index ea33d7685..1e9520d46 100644
	--- a/lib/pleroma/web/media_proxy/controller.ex
	+++ b/lib/pleroma/web/media_proxy/media_proxy_controller.ex
	@@ -1,39 +1,41 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MediaProxy.MediaProxyController do
	use Pleroma.Web, :controller
	alias Pleroma.ReverseProxy
	alias Pleroma.Web.MediaProxy

	@default_proxy_opts [max_body_length: 25 * 1_048_576, http: [follow_redirect: true]]

	def remote(conn, %{"sig" => sig64, "url" => url64} = params) do
	with config <- Pleroma.Config.get([:media_proxy], []),
	true <- Keyword.get(config, :enabled, false),
	{:ok, url} <- MediaProxy.decode_url(sig64, url64),
	- :ok <- filename_matches(Map.has_key?(params, "filename"), conn.request_path, url) do
	+ :ok <- filename_matches(params, conn.request_path, url) do
	ReverseProxy.call(conn, url, Keyword.get(config, :proxy_opts, @default_proxy_opts))
	else
	false ->
	send_resp(conn, 404, Plug.Conn.Status.reason_phrase(404))

	{:error, :invalid_signature} ->
	send_resp(conn, 403, Plug.Conn.Status.reason_phrase(403))

	{:wrong_filename, filename} ->
	redirect(conn, external: MediaProxy.build_url(sig64, url64, filename))
	end
	end

	- def filename_matches(has_filename, path, url) do
	- filename = url \|> MediaProxy.filename()
	+ def filename_matches(%{"filename" => _} = _, path, url) do
	+ filename = MediaProxy.filename(url)

	- if has_filename && filename && Path.basename(path) != filename do
	+ if filename && Path.basename(path) != filename do
	{:wrong_filename, filename}
	else
	:ok
	end
	end
	+
	+ def filename_matches(_, _, _), do: :ok
	end
	diff --git a/mix.exs b/mix.exs
	index f96789d21..aa4440351 100644
	--- a/mix.exs
	+++ b/mix.exs
	@@ -1,249 +1,249 @@
	defmodule Pleroma.Mixfile do
	use Mix.Project

	def project do
	[
	app: :pleroma,
	version: version("1.0.0"),
	elixir: "~> 1.7",
	elixirc_paths: elixirc_paths(Mix.env()),
	compilers: [:phoenix, :gettext] ++ Mix.compilers(),
	elixirc_options: [warnings_as_errors: true],
	xref: [exclude: [:eldap]],
	start_permanent: Mix.env() == :prod,
	aliases: aliases(),
	deps: deps(),
	test_coverage: [tool: ExCoveralls],
	-
	+ preferred_cli_env: ["coveralls.html": :test],
	# Docs
	name: "Pleroma",
	homepage_url: "https://pleroma.social/",
	source_url: "https://git.pleroma.social/pleroma/pleroma",
	docs: [
	source_url_pattern:
	"https://git.pleroma.social/pleroma/pleroma/blob/develop/%{path}#L%{line}",
	logo: "priv/static/static/logo.png",
	extras: ["README.md", "CHANGELOG.md"] ++ Path.wildcard("docs/*/.md"),
	groups_for_extras: [
	"Installation manuals": Path.wildcard("docs/installation/*.md"),
	Configuration: Path.wildcard("docs/config/*.md"),
	Administration: Path.wildcard("docs/admin/*.md"),
	"Pleroma's APIs and Mastodon API extensions": Path.wildcard("docs/api/*.md")
	],
	main: "readme",
	output: "priv/static/doc"
	],
	releases: [
	pleroma: [
	include_executables_for: [:unix],
	applications: [ex_syslogger: :load, syslog: :load],
	steps: [:assemble, &copy_files/1, &copy_nginx_config/1]
	]
	]
	]
	end

	def copy_files(%{path: target_path} = release) do
	File.cp_r!("./rel/files", target_path)
	release
	end

	def copy_nginx_config(%{path: target_path} = release) do
	File.cp!(
	"./installation/pleroma.nginx",
	Path.join([target_path, "installation", "pleroma.nginx"])
	)

	release
	end

	# Configuration for the OTP application.
	#
	# Type `mix help compile.app` for more information.
	def application do
	[
	mod: {Pleroma.Application, []},
	extra_applications: [:logger, :runtime_tools, :comeonin, :quack],
	included_applications: [:ex_syslogger]
	]
	end

	# Specifies which paths to compile per environment.
	defp elixirc_paths(:test), do: ["lib", "test/support"]
	defp elixirc_paths(_), do: ["lib"]

	# Specifies OAuth dependencies.
	defp oauth_deps do
	oauth_strategy_packages =
	System.get_env("OAUTH_CONSUMER_STRATEGIES")
	\|> to_string()
	\|> String.split()
	\|> Enum.map(fn strategy_entry ->
	with [_strategy, dependency] <- String.split(strategy_entry, ":") do
	dependency
	else
	[strategy] -> "ueberauth_#{strategy}"
	end
	end)

	for s <- oauth_strategy_packages, do: {String.to_atom(s), ">= 0.0.0"}
	end

	# Specifies your project dependencies.
	#
	# Type `mix help deps` for examples and options.
	defp deps do
	[
	{:phoenix, "~> 1.4.8"},
	{:plug_cowboy, "~> 2.0"},
	{:phoenix_pubsub, "~> 1.1"},
	{:phoenix_ecto, "~> 4.0"},
	{:ecto_sql, "~> 3.1"},
	{:postgrex, ">= 0.13.5"},
	{:gettext, "~> 0.15"},
	{:comeonin, "~> 4.1.1"},
	{:pbkdf2_elixir, "~> 0.12.3"},
	{:trailing_format_plug, "~> 0.0.7"},
	{:html_sanitize_ex, "~> 1.3.0"},
	{:html_entities, "~> 0.4"},
	{:phoenix_html, "~> 2.10"},
	{:calendar, "~> 0.17.4"},
	{:cachex, "~> 3.0.2"},
	{:poison, "~> 3.0", override: true},
	{:tesla, "~> 1.2"},
	{:jason, "~> 1.0"},
	{:mogrify, "~> 0.6.1"},
	{:ex_aws, "~> 2.0"},
	{:ex_aws_s3, "~> 2.0"},
	{:earmark, "~> 1.3"},
	{:bbcode, "~> 0.1.1"},
	{:ex_machina, "~> 2.3", only: :test},
	{:credo, "~> 0.9.3", only: [:dev, :test]},
	{:mock, "~> 0.3.3", only: :test},
	{:crypt,
	git: "https://github.com/msantos/crypt", ref: "1f2b58927ab57e72910191a7ebaeff984382a1d3"},
	{:cors_plug, "~> 1.5"},
	{:ex_doc, "~> 0.20.2", only: :dev, runtime: false},
	{:web_push_encryption, "~> 0.2.1"},
	{:swoosh, "~> 0.23.2"},
	{:gen_smtp, "~> 0.13"},
	{:websocket_client, git: "https://github.com/jeremyong/websocket_client.git", only: :test},
	{:floki, "~> 0.20.0"},
	{:ex_syslogger, github: "slashmili/ex_syslogger", tag: "1.4.0"},
	{:timex, "~> 3.5"},
	{:ueberauth, "~> 0.4"},
	{:auto_linker,
	git: "https://git.pleroma.social/pleroma/auto_linker.git",
	ref: "95e8188490e97505c56636c1379ffdf036c1fdde"},
	{:http_signatures,
	git: "https://git.pleroma.social/pleroma/http_signatures.git",
	ref: "9789401987096ead65646b52b5a2ca6bf52fc531"},
	{:pleroma_job_queue, "~> 0.2.0"},
	{:telemetry, "~> 0.3"},
	{:prometheus_ex, "~> 3.0"},
	{:prometheus_plugs, "~> 1.1"},
	{:prometheus_phoenix, "~> 1.2"},
	{:prometheus_ecto, "~> 1.4"},
	{:recon, github: "ferd/recon", tag: "2.4.0"},
	{:quack, "~> 0.1.1"},
	{:benchee, "~> 1.0"},
	{:esshd, "~> 0.1.0", runtime: Application.get_env(:esshd, :enabled, false)},
	{:ex_rated, "~> 1.3"},
	{:plug_static_index_html, "~> 1.0.0"},
	{:excoveralls, "~> 0.11.1", only: :test},
	{:mox, "~> 0.5", only: :test}
	] ++ oauth_deps()
	end

	# Aliases are shortcuts or tasks specific to the current project.
	# For example, to create, migrate and run the seeds file at once:
	#
	# $ mix ecto.setup
	#
	# See the documentation for `Mix` for more info on aliases.
	defp aliases do
	[
	"ecto.migrate": ["pleroma.ecto.migrate"],
	"ecto.rollback": ["pleroma.ecto.rollback"],
	"ecto.setup": ["ecto.create", "ecto.migrate", "run priv/repo/seeds.exs"],
	"ecto.reset": ["ecto.drop", "ecto.setup"],
	test: ["ecto.create --quiet", "ecto.migrate", "test"]
	]
	end

	# Builds a version string made of:
	# * the application version
	# * a pre-release if ahead of the tag: the describe string (-count-commithash)
	# * branch name
	# * build metadata:
	# * a build name if `PLEROMA_BUILD_NAME` or `:pleroma, :build_name` is defined
	# * the mix environment if different than prod
	defp version(version) do
	identifier_filter = ~r/[^0-9a-z\-]+/i

	# Pre-release version, denoted from patch version with a hyphen
	{git_tag, git_pre_release} =
	with {tag, 0} <-
	System.cmd("git", ["describe", "--tags", "--abbrev=0"], stderr_to_stdout: true),
	tag = String.trim(tag),
	{describe, 0} <- System.cmd("git", ["describe", "--tags", "--abbrev=8"]),
	describe = String.trim(describe),
	ahead <- String.replace(describe, tag, "") do
	{String.replace_prefix(tag, "v", ""), if(ahead != "", do: String.trim(ahead))}
	else
	_ ->
	{commit_hash, 0} = System.cmd("git", ["rev-parse", "--short", "HEAD"])
	{nil, "-0-g" <> String.trim(commit_hash)}
	end

	if git_tag && version != git_tag do
	Mix.shell().error(
	"Application version #{inspect(version)} does not match git tag #{inspect(git_tag)}"
	)
	end

	# Branch name as pre-release version component, denoted with a dot
	branch_name =
	with {branch_name, 0} <- System.cmd("git", ["rev-parse", "--abbrev-ref", "HEAD"]),
	branch_name <- System.get_env("PLEROMA_BUILD_BRANCH") \|\| branch_name,
	true <- branch_name != "master" do
	branch_name =
	branch_name
	\|> String.trim()
	\|> String.replace(identifier_filter, "-")

	"." <> branch_name
	end

	build_name =
	cond do
	name = Application.get_env(:pleroma, :build_name) -> name
	name = System.get_env("PLEROMA_BUILD_NAME") -> name
	true -> nil
	end

	env_name = if Mix.env() != :prod, do: to_string(Mix.env())
	env_override = System.get_env("PLEROMA_BUILD_ENV")

	env_name =
	case env_override do
	nil -> env_name
	env_override when env_override in ["", "prod"] -> nil
	env_override -> env_override
	end

	# Build metadata, denoted with a plus sign
	build_metadata =
	[build_name, env_name]
	\|> Enum.filter(fn string -> string && string != "" end)
	\|> Enum.join(".")
	\|> (fn
	"" -> nil
	string -> "+" <> String.replace(string, identifier_filter, "-")
	end).()

	[version, git_pre_release, branch_name, build_metadata]
	\|> Enum.filter(fn string -> string && string != "" end)
	\|> Enum.join()
	end
	end
	diff --git a/test/web/media_proxy/media_proxy_controller_test.exs b/test/web/media_proxy/media_proxy_controller_test.exs
	new file mode 100644
	index 000000000..53b8f556b
	--- /dev/null
	+++ b/test/web/media_proxy/media_proxy_controller_test.exs
	@@ -0,0 +1,73 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do
	+ use Pleroma.Web.ConnCase
	+ import Mock
	+ alias Pleroma.Config
	+
	+ setup do
	+ media_proxy_config = Config.get([:media_proxy]) \|\| []
	+ on_exit(fn -> Config.put([:media_proxy], media_proxy_config) end)
	+ :ok
	+ end
	+
	+ test "it returns 404 when MediaProxy disabled", %{conn: conn} do
	+ Config.put([:media_proxy, :enabled], false)
	+
	+ assert %Plug.Conn{
	+ status: 404,
	+ resp_body: "Not Found"
	+ } = get(conn, "/proxy/hhgfh/eeeee")
	+
	+ assert %Plug.Conn{
	+ status: 404,
	+ resp_body: "Not Found"
	+ } = get(conn, "/proxy/hhgfh/eeee/fff")
	+ end
	+
	+ test "it returns 403 when signature invalidated", %{conn: conn} do
	+ Config.put([:media_proxy, :enabled], true)
	+ Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	+ path = URI.parse(Pleroma.Web.MediaProxy.encode_url("https://google.fn")).path
	+ Config.put([Pleroma.Web.Endpoint, :secret_key_base], "000")
	+
	+ assert %Plug.Conn{
	+ status: 403,
	+ resp_body: "Forbidden"
	+ } = get(conn, path)
	+
	+ assert %Plug.Conn{
	+ status: 403,
	+ resp_body: "Forbidden"
	+ } = get(conn, "/proxy/hhgfh/eeee")
	+
	+ assert %Plug.Conn{
	+ status: 403,
	+ resp_body: "Forbidden"
	+ } = get(conn, "/proxy/hhgfh/eeee/fff")
	+ end
	+
	+ test "redirects on valid url when filename invalidated", %{conn: conn} do
	+ Config.put([:media_proxy, :enabled], true)
	+ Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	+ url = Pleroma.Web.MediaProxy.encode_url("https://google.fn/test.png")
	+ invalid_url = String.replace(url, "test.png", "test-file.png")
	+ response = get(conn, invalid_url)
	+ html = "<html><body>You are being <a href=\"#{url}\">redirected</a>.</body></html>"
	+ assert response.status == 302
	+ assert response.resp_body == html
	+ end
	+
	+ test "it performs ReverseProxy.call when signature valid", %{conn: conn} do
	+ Config.put([:media_proxy, :enabled], true)
	+ Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	+ url = Pleroma.Web.MediaProxy.encode_url("https://google.fn/test.png")
	+
	+ with_mock Pleroma.ReverseProxy,
	+ call: fn _conn, _url, _opts -> %Plug.Conn{status: :success} end do
	+ assert %Plug.Conn{status: :success} = get(conn, url)
	+ end
	+ end
	+end
	diff --git a/test/media_proxy_test.exs b/test/web/media_proxy/media_proxy_test.exs
	similarity index 92%
	rename from test/media_proxy_test.exs
	rename to test/web/media_proxy/media_proxy_test.exs
	index fbf200931..cb4807e0b 100644
	--- a/test/media_proxy_test.exs
	+++ b/test/web/media_proxy/media_proxy_test.exs
	@@ -1,209 +1,215 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.MediaProxyTest do
	+defmodule Pleroma.Web.MediaProxyTest do
	use ExUnit.Case
	import Pleroma.Web.MediaProxy
	alias Pleroma.Web.MediaProxy.MediaProxyController

	setup do
	enabled = Pleroma.Config.get([:media_proxy, :enabled])
	on_exit(fn -> Pleroma.Config.put([:media_proxy, :enabled], enabled) end)
	:ok
	end

	describe "when enabled" do
	setup do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	:ok
	end

	test "ignores invalid url" do
	assert url(nil) == nil
	assert url("") == nil
	end

	test "ignores relative url" do
	assert url("/local") == "/local"
	assert url("/") == "/"
	end

	test "ignores local url" do
	local_url = Pleroma.Web.Endpoint.url() <> "/hello"
	local_root = Pleroma.Web.Endpoint.url()
	assert url(local_url) == local_url
	assert url(local_root) == local_root
	end

	test "encodes and decodes URL" do
	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(
	encoded,
	Pleroma.Config.get([:media_proxy, :base_url], Pleroma.Web.base_url())
	)

	assert String.ends_with?(encoded, "/logo.png")

	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without a path" do
	url = "https://pleroma.soykaf.com"
	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without an extension" do
	url = "https://pleroma.soykaf.com/path/"
	encoded = url(url)
	assert String.ends_with?(encoded, "/path")
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL and ignores query params for the path" do
	url = "https://pleroma.soykaf.com/static/logo.png?93939393939&bunny=true"
	encoded = url(url)
	assert String.ends_with?(encoded, "/logo.png")
	assert decode_result(encoded) == url
	end

	test "validates signature" do
	secret_key_base = Pleroma.Config.get([Pleroma.Web.Endpoint, :secret_key_base])

	on_exit(fn ->
	Pleroma.Config.put([Pleroma.Web.Endpoint, :secret_key_base], secret_key_base)
	end)

	encoded = url("https://pleroma.social")

	Pleroma.Config.put(
	[Pleroma.Web.Endpoint, :secret_key_base],
	"00000000000000000000000000000000000000000000000"
	)

	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	assert decode_url(sig, base64) == {:error, :invalid_signature}
	end

	test "filename_matches preserves the encoded or decoded path" do
	assert MediaProxyController.filename_matches(
	- true,
	+ %{"filename" => "/Hello world.jpg"},
	"/Hello world.jpg",
	"http://pleroma.social/Hello world.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	- true,
	+ %{"filename" => "/Hello%20world.jpg"},
	"/Hello%20world.jpg",
	"http://pleroma.social/Hello%20world.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	- true,
	+ %{"filename" => "/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"},
	"/my%2Flong%2Furl%2F2019%2F07%2FS.jpg",
	"http://pleroma.social/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"
	) == :ok
	+
	+ assert MediaProxyController.filename_matches(
	+ %{"filename" => "/my%2Flong%2Furl%2F2019%2F07%2FS.jp"},
	+ "/my%2Flong%2Furl%2F2019%2F07%2FS.jp",
	+ "http://pleroma.social/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"
	+ ) == {:wrong_filename, "my%2Flong%2Furl%2F2019%2F07%2FS.jpg"}
	end

	test "uses the configured base_url" do
	base_url = Pleroma.Config.get([:media_proxy, :base_url])

	if base_url do
	on_exit(fn ->
	Pleroma.Config.put([:media_proxy, :base_url], base_url)
	end)
	end

	Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")

	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, Pleroma.Config.get([:media_proxy, :base_url]))
	end

	# Some sites expect ASCII encoded characters in the URL to be preserved even if
	# unnecessary.
	# Issues: https://git.pleroma.social/pleroma/pleroma/issues/580
	# https://git.pleroma.social/pleroma/pleroma/issues/1055
	test "preserve ASCII encoding" do
	url =
	"https://pleroma.com/%20/%21/%22/%23/%24/%25/%26/%27/%28/%29/%2A/%2B/%2C/%2D/%2E/%2F/%30/%31/%32/%33/%34/%35/%36/%37/%38/%39/%3A/%3B/%3C/%3D/%3E/%3F/%40/%41/%42/%43/%44/%45/%46/%47/%48/%49/%4A/%4B/%4C/%4D/%4E/%4F/%50/%51/%52/%53/%54/%55/%56/%57/%58/%59/%5A/%5B/%5C/%5D/%5E/%5F/%60/%61/%62/%63/%64/%65/%66/%67/%68/%69/%6A/%6B/%6C/%6D/%6E/%6F/%70/%71/%72/%73/%74/%75/%76/%77/%78/%79/%7A/%7B/%7C/%7D/%7E/%7F/%80/%81/%82/%83/%84/%85/%86/%87/%88/%89/%8A/%8B/%8C/%8D/%8E/%8F/%90/%91/%92/%93/%94/%95/%96/%97/%98/%99/%9A/%9B/%9C/%9D/%9E/%9F/%C2%A0/%A1/%A2/%A3/%A4/%A5/%A6/%A7/%A8/%A9/%AA/%AB/%AC/%C2%AD/%AE/%AF/%B0/%B1/%B2/%B3/%B4/%B5/%B6/%B7/%B8/%B9/%BA/%BB/%BC/%BD/%BE/%BF/%C0/%C1/%C2/%C3/%C4/%C5/%C6/%C7/%C8/%C9/%CA/%CB/%CC/%CD/%CE/%CF/%D0/%D1/%D2/%D3/%D4/%D5/%D6/%D7/%D8/%D9/%DA/%DB/%DC/%DD/%DE/%DF/%E0/%E1/%E2/%E3/%E4/%E5/%E6/%E7/%E8/%E9/%EA/%EB/%EC/%ED/%EE/%EF/%F0/%F1/%F2/%F3/%F4/%F5/%F6/%F7/%F8/%F9/%FA/%FB/%FC/%FD/%FE/%FF"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	# This includes unsafe/reserved characters which are not interpreted as part of the URL
	# and would otherwise have to be ASCII encoded. It is our role to ensure the proxied URL
	# is unmodified, so we are testing these characters anyway.
	test "preserve non-unicode characters per RFC3986" do
	url =
	"https://pleroma.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890-._~:/?#[]@!$&'()*+,;=\|^`{}"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "preserve unicode characters" do
	url = "https://ko.wikipedia.org/wiki/위키백과:대문"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "does not change whitelisted urls" do
	upload_config = Pleroma.Config.get([Pleroma.Upload])
	media_url = "https://media.pleroma.social"
	Pleroma.Config.put([Pleroma.Upload, :base_url], media_url)
	Pleroma.Config.put([:media_proxy, :whitelist], ["media.pleroma.social"])
	Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")

	url = "#{media_url}/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, media_url)

	Pleroma.Config.put([Pleroma.Upload], upload_config)
	end
	end

	describe "when disabled" do
	setup do
	enabled = Pleroma.Config.get([:media_proxy, :enabled])

	if enabled do
	Pleroma.Config.put([:media_proxy, :enabled], false)

	on_exit(fn ->
	Pleroma.Config.put([:media_proxy, :enabled], enabled)
	:ok
	end)
	end

	:ok
	end

	test "does not encode remote urls" do
	assert url("https://google.fr") == "https://google.fr"
	end
	end

	defp decode_result(encoded) do
	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	{:ok, decoded} = decode_url(sig, base64)
	decoded
	end

	test "mediaproxy whitelist" do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	Pleroma.Config.put([:media_proxy, :whitelist], ["google.com", "feld.me"])
	url = "https://feld.me/foo.png"

	unencoded = url(url)
	assert unencoded == url
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Oct 10, 3:07 PM (1 d, 7 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1785286
Default Alt Text: (24 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions