From fadcd7f1a9e41ec9b54f251cf782688bf3d36889 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Wed, 7 Jun 2023 09:19:22 -0400 Subject: [PATCH 1/2] Revert MediaProxy Host header validation Something is going wrong here even though the tests are correct. --- changelog.d/3896.add | 2 +- .../web/media_proxy/media_proxy_controller.ex | 25 ---------------- .../media_proxy_controller_test.exs | 29 ------------------- test/support/conn_case.ex | 5 +--- 4 files changed, 2 insertions(+), 59 deletions(-) diff --git a/changelog.d/3896.add b/changelog.d/3896.add index 36d8286ff..e8fde4c8a 100644 --- a/changelog.d/3896.add +++ b/changelog.d/3896.add @@ -1 +1 @@ -Validate Host header for MediaProxy and Uploads and return a 302 if the base_url has changed +Validate Host header for Uploads and return a 302 if the base_url has changed diff --git a/lib/pleroma/web/media_proxy/media_proxy_controller.ex b/lib/pleroma/web/media_proxy/media_proxy_controller.ex index 20f3a3438..bda5b36ed 100644 --- a/lib/pleroma/web/media_proxy/media_proxy_controller.ex +++ b/lib/pleroma/web/media_proxy/media_proxy_controller.ex @@ -12,7 +12,6 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do alias Pleroma.Web.MediaProxy alias Plug.Conn - plug(:validate_host) plug(:sandbox) def remote(conn, %{"sig" => sig64, "url" => url64}) do @@ -206,30 +205,6 @@ defp media_proxy_opts do Config.get([:media_proxy, :proxy_opts], []) end - defp validate_host(conn, _params) do - %{scheme: proxy_scheme, host: proxy_host, port: proxy_port} = - MediaProxy.base_url() |> URI.parse() - - if match?(^proxy_host, conn.host) do - conn - else - redirect_url = - %URI{ - scheme: proxy_scheme, - host: proxy_host, - port: proxy_port, - path: conn.request_path, - query: conn.query_string - } - |> URI.to_string() - |> String.trim_trailing("?") - - conn - |> Phoenix.Controller.redirect(external: redirect_url) - |> halt() - end - end - defp sandbox(conn, _params) do conn |> merge_resp_headers([{"content-security-policy", "sandbox;"}]) diff --git a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs index deb407709..9ce092fd8 100644 --- a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs +++ b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs @@ -54,35 +54,6 @@ test "it returns 403 for invalid signature", %{conn: conn, url: url} do } = get(conn, "/proxy/hhgfh/eeee/fff") end - test "it returns a 302 for invalid host", %{conn: conn} do - new_proxy_base = "http://mp.localhost/" - - %{scheme: new_proxy_scheme, host: new_proxy_host, port: new_proxy_port} = - URI.parse(new_proxy_base) - - clear_config([:media_proxy, :base_url], new_proxy_base) - - proxy_url = - MediaProxy.encode_url("https://pleroma.social/logo.jpeg") - |> URI.parse() - |> Map.put(:host, "wronghost") - |> URI.to_string() - - expected_url = - URI.parse(proxy_url) - |> Map.put(:host, new_proxy_host) - |> Map.put(:port, new_proxy_port) - |> Map.put(:scheme, new_proxy_scheme) - |> URI.to_string() - - with_mock Pleroma.ReverseProxy, - call: fn _conn, _url, _opts -> %Conn{status: :success} end do - conn = get(conn, proxy_url) - - assert redirected_to(conn, 302) == expected_url - end - end - test "redirects to valid url when filename is invalidated", %{conn: conn, url: url} do invalid_url = String.replace(url, "test.png", "test-file.png") response = get(conn, invalid_url) diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex index c1cb0295b..f010fec33 100644 --- a/test/support/conn_case.ex +++ b/test/support/conn_case.ex @@ -120,9 +120,6 @@ defp json_response_and_validate_schema(conn, _status) do Mox.verify_on_exit!() - {:ok, - conn: - Phoenix.ConnTest.build_conn() - |> Map.put(:host, Pleroma.Web.Endpoint.host())} + {:ok, conn: Phoenix.ConnTest.build_conn()} end end From 1ca1b4b32f2cba5f78a2d55645b8d2814bbfc593 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Wed, 7 Jun 2023 09:25:57 -0400 Subject: [PATCH 2/2] changelog.d --- changelog.d/3902.skip | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 changelog.d/3902.skip diff --git a/changelog.d/3902.skip b/changelog.d/3902.skip new file mode 100644 index 000000000..e69de29bb