mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-10-29 09:42:26 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

[feature/bugfix] Probe S3 storage for CSP uri, add config flag for extra URIs (#2134)

Browse source 
* [feature/bugfix] Probe S3 storage for CSP uri, add config flag for extra URIs

* env parsing tests, my coy mistress
This commit is contained in:
tobi 2023-08-20 13:35:55 +02:00 • committed by GitHub
commit 1e2db7a32f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 343 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

23
cmd/gotosocial/action/server/server.go
View file

@ -204,6 +204,29 @@ var Start action.GTSAction = func(ctx context.Context) error {
middleware.ExtraHeaders(),
}...)
// Instantiate Content-Security-Policy
// middleware, with extra URIs.
cspExtraURIs := make([]string, 0)
// Probe storage to check if extra URI is needed in CSP.
// Error here means something is wrong with storage.
storageCSPUri, err := state.Storage.ProbeCSPUri(ctx)
if err != nil {
return fmt.Errorf("error deriving Content-Security-Policy uri from storage: %w", err)
}
// storageCSPUri may be empty string if
// not S3-backed storage; check for this.
if storageCSPUri != "" {
cspExtraURIs = append(cspExtraURIs, storageCSPUri)
}
// Add any extra CSP URIs from config.
cspExtraURIs = append(cspExtraURIs, config.GetAdvancedCSPExtraURIs()...)
// Add CSP to middlewares.
middlewares = append(middlewares, middleware.ContentSecurityPolicy(cspExtraURIs...))
// attach global middlewares which are used for every request
router.AttachGlobalMiddleware(middlewares...)

30
cmd/gotosocial/action/testrig/testrig.go
View file

@ -70,7 +70,11 @@ var Start action.GTSAction = func(ctx context.Context) error {
testrig.StandardDBSetup(state.DB, nil)
if os.Getenv("GTS_STORAGE_BACKEND") == "s3" {
state.Storage, _ = storage.NewS3Storage()
var err error
state.Storage, err = storage.NewS3Storage()
if err != nil {
return fmt.Errorf("error initializing storage: %w", err)
}
} else {
state.Storage = testrig.NewInMemoryStorage()
}
@ -136,6 +140,29 @@ var Start action.GTSAction = func(ctx context.Context) error {
middleware.ExtraHeaders(),
}...)
// Instantiate Content-Security-Policy
// middleware, with extra URIs.
cspExtraURIs := make([]string, 0)
// Probe storage to check if extra URI is needed in CSP.
// Error here means something is wrong with storage.
storageCSPUri, err := state.Storage.ProbeCSPUri(ctx)
if err != nil {
return fmt.Errorf("error deriving Content-Security-Policy uri from storage: %w", err)
}
// storageCSPUri may be empty string if
// not S3-backed storage; check for this.
if storageCSPUri != "" {
cspExtraURIs = append(cspExtraURIs, storageCSPUri)
}
// Add any extra CSP URIs from config.
cspExtraURIs = append(cspExtraURIs, config.GetAdvancedCSPExtraURIs()...)
// Add CSP to middlewares.
middlewares = append(middlewares, middleware.ContentSecurityPolicy(cspExtraURIs...))
// attach global middlewares which are used for every request
router.AttachGlobalMiddleware(middlewares...)
@ -146,7 +173,6 @@ var Start action.GTSAction = func(ctx context.Context) error {
// build router modules
var idp oidc.IDP
var err error
if config.GetOIDCEnabled() {
idp, err = oidc.NewIDP(ctx)
if err != nil {