A security contact page; HSTS from [server] hsts_max_age 2cbf6f348595

{% extends "base.html" %}

{% block title %}Report a security problem{% endblock %}

{% block content %}

<div class="head"><h1>Report a security problem</h1></div>

<section class="panel prose">

{% if !email.is_empty() %}<p>Write to <strong><span class="secret">{{ email }}</span></strong> <button type="button" class="small" data-copy="{{ email }}">copy</button></p>{% endif %}

{{ body_html|safe }}

<p class="small mute">This page is also named in <a href="/.well-known/security.txt">security.txt</a>.</p>

</section>

{% endblock %}

    /// Strict-Transport-Security's max-age in seconds, sent when

    /// `base_url` is https; 0 sends none (oxygenhub#231). Raise it in

    /// stages: browsers keep it, so it is hard to take back.

    pub hsts_max_age: u64,

        Server {

            bind: "127.0.0.1:7300".into(),

            tls_bind: String::new(),

            base_url: "http://127.0.0.1:7300".into(),

            behind_proxy: false,

            hsts_max_age: 0,

        }

        }

        if let Some(v) = get("OXYHUB_SERVER_HSTS_MAX_AGE") {

            self.server.hsts_max_age = v.parse().unwrap_or(0);

//! Strict-Transport-Security is sent only when `[server] hsts_max_age` is

//! set (oxygenhub#231), raised in stages: browsers keep it.

/// The Strict-Transport-Security value for a site, if it sends one

/// (oxygenhub#231): only for an https address and a max-age above 0.

pub fn hsts(base_url: &str, max_age: u64) -> Option<HeaderValue> {

    (base_url.starts_with("https://") && max_age > 0).then(|| HeaderValue::from_str(&format!("max-age={max_age}")).ok()).flatten()

}

pub async fn security_headers(

    axum::extract::State(hsts): axum::extract::State<Option<HeaderValue>>,

    req: axum::extract::Request,

    next: axum::middleware::Next,

) -> Response {

    if let Some(v) = hsts {

        h.entry(header::STRICT_TRANSPORT_SECURITY).or_insert(v);

    }

    let hsts = headers::hsts(app.config.base_url(), app.config.server.hsts_max_age);

        .layer(axum::middleware::from_fn_with_state(hsts, headers::security_headers))

    // Live pages, CSP reports and the security pages (oxygenhub#204, #222, #224, #230).

    "live",

    "csp-report",

    "security.txt",

    "security-contact",

    /// The /security-contact page's address and text (oxygenhub#230).

    security_email: String,

    security_page: String,

    security_default: &'static str,

    let (security_email, security_page) = super::security_txt::page_settings(app).await;

        security_email,

        security_page,

        security_default: super::security_txt::DEFAULT_PAGE,

        .route("/security-contact", get(security_txt::contact_page))

const EMAIL: &str = "security_email";

const PAGE: &str = "security_page";

/// The longest page text kept.

const MAX_PAGE: usize = 20_000;

/// What `/security-contact` says until an administrator writes their own

/// (oxygenhub#230). It makes no promises on the site's behalf.

pub const DEFAULT_PAGE: &str = "If you think you have found a security problem in this hub, please tell us privately rather than in a public issue, proposal or comment.\n\n\

Please include:\n\n\

- what you found, and where (the page, the API call, the repository if one is involved);\n\

- how to reproduce it, step by step;\n\

- what you think someone could do with it.\n\n\

While you look, please do not read or change other people's data beyond what you need to show the problem, do not run tests that slow the service down for others, and give us a fair chance to fix it before you tell anyone else.\n";

/// The reporting address and the page text (empty when unset).

pub async fn page_settings(app: &Shared) -> (String, String) {

    let get = |k| async move { accounts::setting(&app.db, k).await.ok().flatten().unwrap_or_default() };

    (get(EMAIL).await, get(PAGE).await)

}

#[derive(askama::Template)]

#[template(path = "security_contact.html")]

pub struct ContactPage {

    shell: Shell,

    email: String,

    /// The page text as HTML, sanitised by the Markdown renderer.

    body_html: String,

}

/// `GET /security-contact`: how to report a security problem (oxygenhub#230).

pub async fn contact_page(State(app): State<Shared>, viewer: Viewer) -> Page<ContactPage> {

    let shell = Shell::new(&app, "/security-contact", &viewer);

    let (email, text) = page_settings(&app).await;

    let text = if text.trim().is_empty() { DEFAULT_PAGE.to_string() } else { text };

    Page(ContactPage { shell, email, body_html: crate::render::markdown::render(&text, "", "") })

}

    /// Where reports go, shown on /security-contact.

    #[serde(default)]

    email: String,

    /// The page's text, Markdown; empty for the default.

    #[serde(default)]

    page: String,

    }

    let (email, page) = (f.email.trim(), f.page.trim());

    if !email.is_empty() && contact_uri(email).is_none_or(|u| !u.starts_with("mailto:")) {

        return Err(Error::bad(shell, "The reporting address is an email address, or empty."));

    }

    if page.chars().count() > MAX_PAGE {

        return Err(Error::bad(shell, format!("The page text is at most {MAX_PAGE} characters.")));

    accounts::set_setting(&app.db, EMAIL, email).await.map_err(e)?;

    accounts::set_setting(&app.db, PAGE, page).await.map_err(e)?;

    // No HSTS until a max-age is set (oxygenhub#231).

    assert!(call("GET", "/login", Some(("x-forwarded-proto", "https")), None)

        .await

        .headers()

        .get(header::STRICT_TRANSPORT_SECURITY)

        .is_none());

    assert_eq!(oxygenhub::headers::hsts("https://hub.example.org", 300).unwrap(), "max-age=300");

    assert!(oxygenhub::headers::hsts("http://127.0.0.1:7300", 300).is_none(), "never over plain http");

    assert!(oxygenhub::headers::hsts("https://hub.example.org", 0).is_none());

    // /security-contact (oxygenhub#230): sensible text until it is written,

    // then the address and the administrator's own text.

    let page = get(app, "/security-contact", None).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("Report a security problem") && page.body.contains("tell us privately"), "{}", page.body);

    let r = post(

        app,

        "/admin/security",

        Some(&andy),

        &format!(

            "_csrf={csrf}&contact=https%3A%2F%2Fhub.example%2Fsecurity-contact&email=security%40example.org&page=Mail+us.+**Thank+you.**"

        ),

    )

    .await;

    assert!(r.body.contains("Security contact saved"), "{}", r.body);

    let page = get(app, "/security-contact", None).await.body;

    assert!(

        page.contains("[email protected]") && page.contains("<strong>Thank you.</strong>") && !page.contains("tell us privately"),

        "{page}"

    );

    let r = post(app, "/admin/security", Some(&andy), &format!("_csrf={csrf}&contact=sec%40example.org&email=not-an-address")).await;

    assert_eq!(r.status, StatusCode::BAD_REQUEST);

    assert!(!oxygenhub::repos::names::valid_owner("security-contact") && !oxygenhub::repos::names::valid_owner("live"), "reserved");

is on (2026-10-15). Strict-Transport-Security comes from `[server] hsts_max_age` (seconds;

0, the default, sends none; never over plain http; oxygenhub#231).

Browsers remember it, so raise it in stages: 300 first, a week

(604800) after a few quiet days, then a year (31536000). Add

`includeSubDomains` only once every subdomain is HTTPS, and preload last.

oxygenhub.io is at 300 from 2026-10-16.

`/security-contact` is the page to point the contact at: the reporting

address and Markdown text from the same panel (oxygenhub#230), with

sensible text until it is written.

    <label for="secemail">Reporting address, shown on <a href="/security-contact">/security-contact</a></label><input type="email" id="secemail" name="email" value="{{ security_email }}" placeholder="[email protected]" autocomplete="off">

    <label for="secpage">That page's text (Markdown; empty for the text below)</label><textarea id="secpage" name="page" rows="8" placeholder="{{ security_default }}">{{ security_page }}</textarea>