diff options
author | ThibG <thib@sitedethib.com> | 2020-07-07 16:21:42 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-07-07 16:21:42 +0200 |
commit | c4e1b82caf5c932a3c19bc77726c9e3ab3d2c46a (patch) | |
tree | 432bd5bc0c7ec19aac3175150e397b5336c71a4d /config/initializers | |
parent | 94e09d309cb068ea92919767e40e655260ac43cb (diff) | |
parent | 6c7ac1b48f7d4c6d0a1e0cf7f663c3188421d7c7 (diff) |
Merge pull request #1373 from ThibG/glitch-soc/merge-upstream
Merge upstream changes
Diffstat (limited to 'config/initializers')
-rw-r--r-- | config/initializers/content_security_policy.rb | 18 | ||||
-rw-r--r-- | config/initializers/rack_attack.rb | 37 | ||||
-rw-r--r-- | config/initializers/rack_attack_logging.rb | 1 |
3 files changed, 45 insertions, 11 deletions
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index a76db6fe5..68d3751fc 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -49,7 +49,25 @@ end # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only # Rails.application.config.content_security_policy_report_only = true +Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } + +# Monkey-patching Rails 5 +module ActionDispatch + class ContentSecurityPolicy + def nonce_directive?(directive) + directive == 'style-src' + end + end +end + +# Rails 6 would require the following instead: +# Rails.application.config.content_security_policy_nonce_directives = %w(style-src) + PgHero::HomeController.content_security_policy do |p| p.script_src :self, :unsafe_inline, assets_host p.style_src :self, :unsafe_inline, assets_host end + +PgHero::HomeController.after_action do + request.content_security_policy_nonce_generator = nil +end diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 09458c540..cd29afac5 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -38,15 +38,6 @@ class Rack::Attack end end - PROTECTED_PATHS = %w( - /auth/sign_in - /auth - /auth/password - /auth/confirmation - ).freeze - - PROTECTED_PATHS_REGEX = Regexp.union(PROTECTED_PATHS.map { |path| /\A#{Regexp.escape(path)}/ }) - Rack::Attack.safelist('allow from localhost') do |req| req.remote_ip == '127.0.0.1' || req.remote_ip == '::1' end @@ -86,8 +77,32 @@ class Rack::Attack req.authenticated_user_id if (req.post? && req.path =~ API_DELETE_REBLOG_REGEX) || (req.delete? && req.path =~ API_DELETE_STATUS_REGEX) end - throttle('protected_paths', limit: 25, period: 5.minutes) do |req| - req.remote_ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX + throttle('throttle_sign_up_attempts/ip', limit: 25, period: 5.minutes) do |req| + req.remote_ip if req.post? && req.path == '/auth' + end + + throttle('throttle_password_resets/ip', limit: 25, period: 5.minutes) do |req| + req.remote_ip if req.post? && req.path == '/auth/password' + end + + throttle('throttle_password_resets/email', limit: 5, period: 30.minutes) do |req| + req.params.dig('user', 'email').presence if req.post? && req.path == '/auth/password' + end + + throttle('throttle_email_confirmations/ip', limit: 25, period: 5.minutes) do |req| + req.remote_ip if req.post? && req.path == '/auth/confirmation' + end + + throttle('throttle_email_confirmations/email', limit: 5, period: 30.minutes) do |req| + req.params.dig('user', 'email').presence if req.post? && req.path == '/auth/password' + end + + throttle('throttle_login_attempts/ip', limit: 25, period: 5.minutes) do |req| + req.remote_ip if req.post? && req.path == '/auth/sign_in' + end + + throttle('throttle_login_attempts/email', limit: 25, period: 1.hour) do |req| + req.session[:attempt_user_id] || req.params.dig('user', 'email').presence if req.post? && req.path == '/auth/sign_in' end self.throttled_response = lambda do |env| diff --git a/config/initializers/rack_attack_logging.rb b/config/initializers/rack_attack_logging.rb index c30bd8a64..ab4822e96 100644 --- a/config/initializers/rack_attack_logging.rb +++ b/config/initializers/rack_attack_logging.rb @@ -2,5 +2,6 @@ ActiveSupport::Notifications.subscribe(/rack_attack/) do |_name, _start, _finish req = payload[:request] next unless [:throttle, :blacklist].include? req.env['rack.attack.match_type'] + Rails.logger.info("Rate limit hit (#{req.env['rack.attack.match_type']}): #{req.ip} #{req.request_method} #{req.fullpath}") end |