teh/mastodon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 10

Fix #26849 by adding the domain of the current SSO provider to the form-action CSP (#26857)

Browse source
This commit is contained in:
CSDUMMI 2023-09-12 13:04:51 +02:00 committed by GitHub
parent 93223633fc
commit 9a70cac9de
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/concerns/web_app_controller_concern.rb
View file

@ -11,7 +11,7 @@ module WebAppControllerConcern
end end
def skip_csrf_meta_tags? def skip_csrf_meta_tags?
!(ENV['OMNIAUTH_ONLY'] == 'true' && Devise.omniauth_providers.length == 1) && current_user.nil? !(ENV['ONE_CLICK_SSO_LOGIN'] == 'true' && ENV['OMNIAUTH_ONLY'] == 'true' && Devise.omniauth_providers.length == 1) && current_user.nil?
end end
def set_app_body_class def set_app_body_class

2
app/serializers/initial_state_serializer.rb
View file

@ -113,6 +113,6 @@ class InitialStateSerializer < ActiveModel::Serializer
end end
def sso_redirect def sso_redirect
"/auth/auth/#{Devise.omniauth_providers[0]}" if ENV['OMNIAUTH_ONLY'] == 'true' && Devise.omniauth_providers.length == 1 "/auth/auth/#{Devise.omniauth_providers[0]}" if ENV['ONE_CLICK_SSO_LOGIN'] == 'true' && ENV['OMNIAUTH_ONLY'] == 'true' && Devise.omniauth_providers.length == 1
end end
end end

24
config/initializers/content_security_policy.rb
View file

@ -19,6 +19,22 @@ media_host ||= host_to_url(ENV['AZURE_ALIAS_HOST'])
media_host ||= host_to_url(ENV['S3_HOSTNAME']) if ENV['S3_ENABLED'] == 'true' media_host ||= host_to_url(ENV['S3_HOSTNAME']) if ENV['S3_ENABLED'] == 'true'
media_host ||= assets_host media_host ||= assets_host
def sso_host
return unless ENV['ONE_CLICK_SSO_LOGIN'] == 'true'
return unless ENV['OMNIAUTH_ONLY'] == 'true'
return unless Devise.omniauth_providers.length == 1
provider = Devise.omniauth_configs[Devise.omniauth_providers[0]]
@sso_host ||= begin
# using CAS
provider.cas_url if ENV['CAS_ENABLED'] == 'true'
# using SAML
provider.options[:idp_sso_target_url] if ENV['SAML_ENABLED'] == 'true'
# or using OIDC
ENV['OIDC_AUTH_ENDPOINT'] || (OpenIDConnect::Discovery::Provider::Config.discover!(ENV['OIDC_ISSUER']).authorization_endpoint if ENV['OIDC_ENABLED'] == 'true')
end
end
Rails.application.config.content_security_policy do |p| Rails.application.config.content_security_policy do |p|
p.base_uri :none p.base_uri :none
p.default_src :none p.default_src :none
@ -29,7 +45,13 @@ Rails.application.config.content_security_policy do |p|
p.media_src :self, :https, :data, assets_host p.media_src :self, :https, :data, assets_host
p.frame_src :self, :https p.frame_src :self, :https
p.manifest_src :self, assets_host p.manifest_src :self, assets_host
p.form_action :self
if sso_host.present?
p.form_action :self, sso_host
else
p.form_action :self
end
p.child_src :self, :blob, assets_host p.child_src :self, :blob, assets_host
p.worker_src :self, :blob, assets_host p.worker_src :self, :blob, assets_host