Merge branch 'validate-host' into 'develop'

Validate Host header for MediaProxy and Uploads

See merge request pleroma/pleroma!3896

test/pleroma/web/media_proxy/media_proxy_controller_test.exs

@@ -54,6 +54,40 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do
              } = get(conn, "/proxy/hhgfh/eeee/fff")
     end
 
+    test "it returns a 302 for invalid host", %{conn: conn} do
+      new_proxy_base = "http://mp.localhost/"
+
+      %{scheme: new_proxy_scheme, host: new_proxy_host, port: new_proxy_port} =
+        URI.parse(new_proxy_base)
+
+      clear_config([:media_proxy, :base_url], new_proxy_base)
+
+      proxy_url =
+        MediaProxy.encode_url("https://pleroma.social/logo.jpeg")
+        |> URI.parse()
+        |> Map.put(:host, "wronghost")
+        |> URI.to_string()
+
+      expected_url =
+        URI.parse(proxy_url)
+        |> Map.put(:host, new_proxy_host)
+        |> Map.put(:port, new_proxy_port)
+        |> Map.put(:scheme, new_proxy_scheme)
+        |> URI.to_string()
+
+      with_mock Pleroma.ReverseProxy,
+        call: fn _conn, _url, _opts -> %Conn{status: :success} end do
+        %{resp_headers: resp_headers, status: status} = get(conn, proxy_url)
+
+        assert status == 302
+
+        assert Enum.any?(
+                 resp_headers,
+                 &(&1 == {"location", expected_url})
+               )
+      end
+    end
+
     test "redirects to valid url when filename is invalidated", %{conn: conn, url: url} do
       invalid_url = String.replace(url, "test.png", "test-file.png")
       response = get(conn, invalid_url)

test/pleroma/web/plugs/uploaded_media_plug_test.exs

@@ -40,4 +40,35 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
              &(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]})
            )
   end
+
+  test "denies access to media if wrong Host", %{
+    attachment_url: attachment_url
+  } do
+    conn = get(build_conn(), attachment_url)
+
+    assert conn.status == 200
+
+    new_media_base = "http://media.localhost:8080"
+
+    %{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
+      URI.parse(new_media_base)
+
+    clear_config([Pleroma.Upload, :base_url], new_media_base)
+
+    conn = get(build_conn(), attachment_url)
+
+    expected_url =
+      URI.parse(attachment_url)
+      |> Map.put(:host, new_media_host)
+      |> Map.put(:port, new_media_port)
+      |> Map.put(:scheme, new_media_scheme)
+      |> URI.to_string()
+
+    assert conn.status == 302
+
+    assert Enum.any?(
+             conn.resp_headers,
+             &(&1 == {"location", expected_url})
+           )
+  end
 end

test/support/conn_case.ex

@@ -120,6 +120,9 @@ defmodule Pleroma.Web.ConnCase do
 
     Mox.verify_on_exit!()
 
-    {:ok, conn: Phoenix.ConnTest.build_conn()}
+    {:ok,
+     conn:
+       Phoenix.ConnTest.build_conn()
+       |> Map.put(:host, Pleroma.Web.Endpoint.host())}
   end
 end