From fe67665e19cc98faff4a8ee53a3f4ca4190ca2ef Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 12 Nov 2018 15:08:02 +0000
Subject: rename CSPPlug to HTTPSecurityPlug.

---
 lib/pleroma/plugs/csp_plug.ex           | 57 ---------------------------------
 lib/pleroma/plugs/http_security_plug.ex | 57 +++++++++++++++++++++++++++++++++
 lib/pleroma/web/endpoint.ex             |  2 +-
 3 files changed, 58 insertions(+), 58 deletions(-)
 delete mode 100644 lib/pleroma/plugs/csp_plug.ex
 create mode 100644 lib/pleroma/plugs/http_security_plug.ex

(limited to 'lib')

diff --git a/lib/pleroma/plugs/csp_plug.ex b/lib/pleroma/plugs/csp_plug.ex
deleted file mode 100644
index 8fc21b909..000000000
--- a/lib/pleroma/plugs/csp_plug.ex
+++ /dev/null
@@ -1,57 +0,0 @@
-defmodule Pleroma.Plugs.CSPPlug do
-  alias Pleroma.Config
-  import Plug.Conn
-
-  def init(opts), do: opts
-
-  def call(conn, options) do
-    if Config.get([:csp, :enabled]) do
-      conn =
-        merge_resp_headers(conn, headers())
-        |> maybe_send_sts_header(Config.get([:csp, :sts]))
-    else
-      conn
-    end
-  end
-
-  defp headers do
-    [
-      {"x-xss-protection", "1; mode=block"},
-      {"x-permitted-cross-domain-policies", "none"},
-      {"x-frame-options", "DENY"},
-      {"x-content-type-options", "nosniff"},
-      {"referrer-policy", "same-origin"},
-      {"x-download-options", "noopen"},
-      {"content-security-policy", csp_string() <> ";"}
-    ]
-  end
-
-  defp csp_string do
-    [
-      "default-src 'none'",
-      "base-uri 'self'",
-      "form-action *",
-      "frame-ancestors 'none'",
-      "img-src 'self' data: https:",
-      "media-src 'self' https:",
-      "style-src 'self' 'unsafe-inline'",
-      "font-src 'self'",
-      "script-src 'self'",
-      "connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"),
-      "upgrade-insecure-requests"
-    ]
-    |> Enum.join("; ")
-  end
-
-  defp maybe_send_sts_header(conn, true) do
-    max_age_sts = Config.get([:csp, :sts_max_age])
-    max_age_ct = Config.get([:csp, :ct_max_age])
-
-    merge_resp_headers(conn, [
-      {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
-      {"expect-ct", "enforce, max-age=#{max_age_ct}"}
-    ])
-  end
-
-  defp maybe_send_sts_header(conn, _), do: conn
-end
diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
new file mode 100644
index 000000000..8d652a2f3
--- /dev/null
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -0,0 +1,57 @@
+defmodule Pleroma.Plugs.HTTPSecurityPlug do
+  alias Pleroma.Config
+  import Plug.Conn
+
+  def init(opts), do: opts
+
+  def call(conn, options) do
+    if Config.get([:http_security, :enabled]) do
+      conn =
+        merge_resp_headers(conn, headers())
+        |> maybe_send_sts_header(Config.get([:http_security, :sts]))
+    else
+      conn
+    end
+  end
+
+  defp headers do
+    [
+      {"x-xss-protection", "1; mode=block"},
+      {"x-permitted-cross-domain-policies", "none"},
+      {"x-frame-options", "DENY"},
+      {"x-content-type-options", "nosniff"},
+      {"referrer-policy", "same-origin"},
+      {"x-download-options", "noopen"},
+      {"content-security-policy", csp_string() <> ";"}
+    ]
+  end
+
+  defp csp_string do
+    [
+      "default-src 'none'",
+      "base-uri 'self'",
+      "form-action *",
+      "frame-ancestors 'none'",
+      "img-src 'self' data: https:",
+      "media-src 'self' https:",
+      "style-src 'self' 'unsafe-inline'",
+      "font-src 'self'",
+      "script-src 'self'",
+      "connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"),
+      "upgrade-insecure-requests"
+    ]
+    |> Enum.join("; ")
+  end
+
+  defp maybe_send_sts_header(conn, true) do
+    max_age_sts = Config.get([:http_security, :sts_max_age])
+    max_age_ct = Config.get([:http_security, :ct_max_age])
+
+    merge_resp_headers(conn, [
+      {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
+      {"expect-ct", "enforce, max-age=#{max_age_ct}"}
+    ])
+  end
+
+  defp maybe_send_sts_header(conn, _), do: conn
+end
diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index 370d2d792..7783b8e5c 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -12,7 +12,7 @@ defmodule Pleroma.Web.Endpoint do
   # You should set gzip to true if you are running phoenix.digest
   # when deploying your static files in production.
   plug(CORSPlug)
-  plug(Pleroma.Plugs.CSPPlug)
+  plug(Pleroma.Plugs.HTTPSecurityPlug)
 
   plug(Plug.Static, at: "/media", from: Pleroma.Uploaders.Local.upload_path(), gzip: false)
 
-- 
cgit v1.2.3