Switch from serving a 400 to a 302

This commit is contained in:
Mark Felder 2023-05-30 16:56:09 -04:00
parent da7394f33b
commit b3c3bd99c3
5 changed files with 72 additions and 12 deletions

View File

@ -1 +1 @@
Validate Host header for MediaProxy and Uploads Validate Host header for MediaProxy and Uploads and return a 302 if the base_url has changed

View File

@ -207,12 +207,25 @@ defp media_proxy_opts do
end end
defp validate_host(conn, _params) do defp validate_host(conn, _params) do
proxy_host = MediaProxy.base_url() |> URI.parse() |> Map.get(:host) %{scheme: proxy_scheme, host: proxy_host, port: proxy_port} =
MediaProxy.base_url() |> URI.parse()
if match?(^proxy_host, conn.host) do if match?(^proxy_host, conn.host) do
conn conn
else else
send_resp(conn, 400, Conn.Status.reason_phrase(400)) redirect_url =
%URI{
scheme: proxy_scheme,
host: proxy_host,
port: proxy_port,
path: conn.request_path,
query: conn.query_string
}
|> URI.to_string()
|> String.trim_trailing("?")
conn
|> Phoenix.Controller.redirect(external: redirect_url)
|> halt() |> halt()
end end
end end

View File

@ -46,7 +46,8 @@ def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
config = Pleroma.Config.get(Pleroma.Upload) config = Pleroma.Config.get(Pleroma.Upload)
media_host = Pleroma.Upload.base_url() |> URI.parse() |> Map.get(:host) %{scheme: media_scheme, host: media_host, port: media_port} =
Pleroma.Upload.base_url() |> URI.parse()
with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)}, with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
uploader <- Keyword.fetch!(config, :uploader), uploader <- Keyword.fetch!(config, :uploader),
@ -56,7 +57,19 @@ def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
get_media(conn, get_method, proxy_remote, opts) get_media(conn, get_method, proxy_remote, opts)
else else
{:valid_host, false} -> {:valid_host, false} ->
send_resp(conn, 400, Plug.Conn.Status.reason_phrase(400)) redirect_url =
%URI{
scheme: media_scheme,
host: media_host,
port: media_port,
path: conn.request_path,
query: conn.query_string
}
|> URI.to_string()
|> String.trim_trailing("?")
conn
|> Phoenix.Controller.redirect(external: redirect_url)
|> halt() |> halt()
_ -> _ ->

View File

@ -54,20 +54,37 @@ test "it returns 403 for invalid signature", %{conn: conn, url: url} do
} = get(conn, "/proxy/hhgfh/eeee/fff") } = get(conn, "/proxy/hhgfh/eeee/fff")
end end
test "it returns a 400 for invalid host", %{conn: conn} do test "it returns a 302 for invalid host", %{conn: conn} do
clear_config([:media_proxy, :base_url], "http://mp.localhost/") new_proxy_base = "http://mp.localhost/"
url = %{scheme: new_proxy_scheme, host: new_proxy_host, port: new_proxy_port} =
URI.parse(new_proxy_base)
clear_config([:media_proxy, :base_url], new_proxy_base)
proxy_url =
MediaProxy.encode_url("https://pleroma.social/logo.jpeg") MediaProxy.encode_url("https://pleroma.social/logo.jpeg")
|> URI.parse() |> URI.parse()
|> Map.put(:host, "wronghost") |> Map.put(:host, "wronghost")
|> URI.to_string() |> URI.to_string()
expected_url =
URI.parse(proxy_url)
|> Map.put(:host, new_proxy_host)
|> Map.put(:port, new_proxy_port)
|> Map.put(:scheme, new_proxy_scheme)
|> URI.to_string()
with_mock Pleroma.ReverseProxy, with_mock Pleroma.ReverseProxy,
call: fn _conn, _url, _opts -> %Conn{status: :success} end do call: fn _conn, _url, _opts -> %Conn{status: :success} end do
%{status: status} = get(conn, url) %{resp_headers: resp_headers, status: status} = get(conn, proxy_url)
assert status == 400 assert status == 302
assert Enum.any?(
resp_headers,
&(&1 == {"location", expected_url})
)
end end
end end

View File

@ -48,10 +48,27 @@ test "denies access to media if wrong Host", %{
assert conn.status == 200 assert conn.status == 200
clear_config([Pleroma.Upload, :base_url], "http://media.localhost/") new_media_base = "http://media.localhost:8080"
%{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
URI.parse(new_media_base)
clear_config([Pleroma.Upload, :base_url], new_media_base)
conn = get(build_conn(), attachment_url) conn = get(build_conn(), attachment_url)
assert conn.status == 400 expected_url =
URI.parse(attachment_url)
|> Map.put(:host, new_media_host)
|> Map.put(:port, new_media_port)
|> Map.put(:scheme, new_media_scheme)
|> URI.to_string()
assert conn.status == 302
assert Enum.any?(
conn.resp_headers,
&(&1 == {"location", expected_url})
)
end end
end end