ApiCSPReport.php

Go to the documentation of this file.

<?php
use MediaWiki\Logger\LoggerFactory;

class ApiCSPReport extends ApiBase {

    private $log;

    const MAX_POST_SIZE = 8192;

    public function execute() {
        $reportOnly = $this->getParameter( 'reportonly' );
        $logname = $reportOnly ? 'csp-report-only' : 'csp';
        $this->log = LoggerFactory::getInstance( $logname );
        $userAgent = $this->getRequest()->getHeader( 'user-agent' );

        $this->verifyPostBodyOk();
        $report = $this->getReport();
        $flags = $this->getFlags( $report );

        $warningText = $this->generateLogLine( $flags, $report );
        $this->logReport( $flags, $warningText, [
            // XXX Is it ok to put untrusted data into log??
            'csp-report' => $report,
            'method' => __METHOD__,
            'user' => $this->getUser()->getName(),
            'user-agent' => $userAgent,
            'source' => $this->getParameter( 'source' ),
        ] );
        $this->getResult()->addValue( null, $this->getModuleName(), 'success' );
    }

    private function logReport( $flags, $logLine, $context ) {
        if ( in_array( 'false-positive', $flags ) ) {
            // These reports probably don't matter much
            $this->log->debug( $logLine, $context );
        } else {
            // Normal report.
            $this->log->warning( $logLine, $context );
        }
    }

    private function getFlags( $report ) {
        $reportOnly = $this->getParameter( 'reportonly' );
        $source = $this->getParameter( 'source' );
        $falsePositives = $this->getConfig()->get( 'CSPFalsePositiveUrls' );

        $flags = [];
        if ( $source !== 'internal' ) {
            $flags[] = 'source=' . $source;
        }
        if ( $reportOnly ) {
            $flags[] = 'report-only';
        }

        if (
            ( isset( $report['blocked-uri'] ) &&
            isset( $falsePositives[$report['blocked-uri']] ) )
            || ( isset( $report['source-file'] ) &&
            isset( $falsePositives[$report['source-file']] ) )
        ) {
            // Report caused by Ad-Ware
            $flags[] = 'false-positive';
        }
        return $flags;
    }

    private function verifyPostBodyOk() {
        $req = $this->getRequest();
        $contentType = $req->getHeader( 'content-type' );
        if ( $contentType !== 'application/json'
            && $contentType !=='application/csp-report'
        ) {
            $this->error( 'wrongformat', __METHOD__ );
        }
        if ( $req->getHeader( 'content-length' ) > self::MAX_POST_SIZE ) {
            $this->error( 'toobig', __METHOD__ );
        }
    }

    private function getReport() {
        $postBody = $this->getRequest()->getRawInput();
        if ( strlen( $postBody ) > self::MAX_POST_SIZE ) {
            // paranoia, already checked content-length earlier.
            $this->error( 'toobig', __METHOD__ );
        }
        $status = FormatJson::parse( $postBody, FormatJson::FORCE_ASSOC );
        if ( !$status->isGood() ) {
            list( $code, ) = $this->getErrorFromStatus( $status );
            $this->error( $code, __METHOD__ );
        }

        $report = $status->getValue();

        if ( !isset( $report['csp-report'] ) ) {
            $this->error( 'missingkey', __METHOD__ );
        }
        return $report['csp-report'];
    }

    private function generateLogLine( $flags, $report ) {
        $flagText = '';
        if ( $flags ) {
            $flagText = '[' . implode( $flags, ', ' ) . ']';
        }

        $blockedFile = isset( $report['blocked-uri'] ) ? $report['blocked-uri'] : 'n/a';
        $page = isset( $report['document-uri'] ) ? $report['document-uri'] : 'n/a';
        $line = isset( $report['line-number'] ) ? ':' . $report['line-number'] : '';
        $warningText = $flagText .
            ' Received CSP report: <' . $blockedFile .
            '> blocked from being loaded on <' . $page . '>' . $line;
        return $warningText;
    }

    private function error( $code, $method ) {
        $this->log->info( 'Error reading CSP report: ' . $code, [
            'method' => $method,
            'user-agent' => $this->getRequest()->getHeader( 'user-agent' )
        ] );
        // 500 so it shows up in browser's developer console.
        $this->dieUsage( "Error processing CSP report: $code", 'cspreport-' . $code, 500 );
    }

    public function getAllowedParams() {
        return [
            'reportonly' => [
                ApiBase::PARAM_TYPE => 'boolean',
                ApiBase::PARAM_DFLT => false
            ],
            'source' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_DFLT => 'internal',
                ApiBase::PARAM_REQUIRED => false
            ]
        ];
    }

    public function mustBePosted() {
        return true;
    }

    public function isWriteMode() {
        return false;
    }

    public function isInternal() {
        return true;
    }

    public function isReadMode() {
        return false;
    }

    public function shouldCheckMaxLag() {
        return false;
    }
}