Plume/Plume

Fork 24

Default CSP breaks federated media #618

New issue

Open

opened 2019-06-17 21:18:12 +00:00 by ealgase · 5 comments

ealgase commented

2019-06-17 21:18:12 +00:00

(Migrated from github.com)

Look at this post: https://fediverse.blog/~~/EveryFediverseInstance/peertube.social-instance-review-peer-tube on any other instance: https://cafe.sunbeam.city/~~/EveryFediverseInstance@fediverse.blog/peertube.social-instance-review-peer-tube and the media will not load. This is because the media is hotlinked to the original instance, but the strict content security policy doesn't allow it to be loaded

Plume version: any (although it's not present on all instances since some use custom CSP's)
Operating system: Chrome OS
Web Browser: Google Chrome

Look at this post: https://fediverse.blog/~/EveryFediverseInstance/peertube.social-instance-review-peer-tube on any other instance: https://cafe.sunbeam.city/~/EveryFediverseInstance@fediverse.blog/peertube.social-instance-review-peer-tube and the media will not load. This is because the media is hotlinked to the original instance, but the strict content security policy doesn't allow it to be loaded ![image](https://user-images.githubusercontent.com/11603778/59637399-b3ec4700-9123-11e9-942c-943be2259351.png)  - **Plume version:** any (although it's not present on all instances since some use custom CSP's) - **Operating system:** Chrome OS - **Web Browser:** Google Chrome

trinity-1686a commented

2019-06-17 23:16:13 +00:00

Owner

related and not related at the same time, instance having a permissive csp are subject to tracking by inserting a 'pixel' in a blog post, so a good fix would probably be for instances to have a cache for remote medias (or at the very least be a dumb proxy) and serve them by itself, without requiring the client to contact an other server

👍 1

ealgase commented

2019-06-17 23:56:30 +00:00

(Migrated from github.com)

Agree, a cache or proxy for remote media is probably a good choice, but without that, I'd think unbreaking posts is worth the potential risk of a tracking pixel (since after all, a user who really cares would have an extension like uBlock Origin to block it).

👍 2

iamdoubz commented

2019-07-01 19:42:03 +00:00

(Migrated from github.com)

I have been testing my own CSP, but Google Chrome recently (maybe not so recently) added something that blocks wasm resources outright. Works in all other browsers though:

[Report Only] Refused to compile or instantiate WebAssembly module because 'wasm-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' my.plume.url"

My actual apache line:
Header always set Content-Security-Policy-Report-Only "default-src 'self' https:; font-src 'self' data: my.plume.url; media-src 'self' my.plume.url; script-src 'self' my.plume.url; style-src 'self' my.plume.url 'unsafe-inline'; img-src 'self' https: data: blob: my.plume.url; worker-src *; frame-src 'none'; connect-src 'self' wss: https: my.plume.url;"

I have been testing my own CSP, but Google Chrome recently (maybe not so recently) added something that blocks wasm resources outright. Works in all other browsers though: ``` [Report Only] Refused to compile or instantiate WebAssembly module because 'wasm-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' my.plume.url" ``` My actual apache line: `Header always set Content-Security-Policy-Report-Only "default-src 'self' https:; font-src 'self' data: my.plume.url; media-src 'self' my.plume.url; script-src 'self' my.plume.url; style-src 'self' my.plume.url 'unsafe-inline'; img-src 'self' https: data: blob: my.plume.url; worker-src *; frame-src 'none'; connect-src 'self' wss: https: my.plume.url;"`

👍 2

elegaanz commented

2019-07-01 20:21:08 +00:00

(Migrated from github.com)

@iamdoubz Try to update it to

Header always set Content-Security-Policy-Report-Only "default-src 'self' https:; font-src 'self' data: my.plume.url; media-src 'self' my.plume.url; script-src 'self' my.plume.url 'wasm-eval'; style-src 'self' my.plume.url 'unsafe-inline'; img-src 'self' https: data: blob: my.plume.url; worker-src *; frame-src 'none'; connect-src 'self' wss: https: my.plume.url;"

for the moment (I didn't tested, but reading the error message, it may fix your issue). We probably need to update the config files in the docs to avoid this issue (or maybe we could provide the CSP header directly from Plume?).

@iamdoubz Try to update it to ``` Header always set Content-Security-Policy-Report-Only "default-src 'self' https:; font-src 'self' data: my.plume.url; media-src 'self' my.plume.url; script-src 'self' my.plume.url 'wasm-eval'; style-src 'self' my.plume.url 'unsafe-inline'; img-src 'self' https: data: blob: my.plume.url; worker-src *; frame-src 'none'; connect-src 'self' wss: https: my.plume.url;" ``` for the moment (I didn't tested, but reading the error message, it may fix your issue). We probably need to update the config files in the docs to avoid this issue (or maybe we could provide the CSP header directly from Plume?).

iamdoubz commented

2019-07-01 20:33:09 +00:00

(Migrated from github.com)

See this discussion for more info: https://github.com/WebAssembly/content-security-policy/issues/7
And also this: https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md

The 'wasm-eval' directive is only implemented to Chrome apps. So, you get a warning telling you that the directive does not exist. Also, I don't think putting a default CSP into the server configuration would be a great idea. If a user wants to change from the defaults, it would be easier for them to change it they that they may or may not be used to i.e. from Apache etc. See this discussion for more info: https://github.com/WebAssembly/content-security-policy/issues/7 And also this: https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md

👍 2

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Plume/Plume#618

No description provided.

Rows
Columns