security.txt from a contact set under Administration 3dd6582de060

//! `security.txt` (RFC 9116, oxygenhub#224): where to report a

//! vulnerability in this hub. A site administrator sets the contact and,

//! if there is one, a policy page under Administration; until a contact is

//! set there is no file (404). `Expires` is always just under a year ahead,

//! as the RFC asks, so the file never goes stale.

use super::settings::csrf;

use super::{Error, Page, Shell};

use crate::auth::Viewer;

use crate::db::{self, accounts};

use crate::Shared;

use axum::extract::{Form, State};

use axum::http::{header, StatusCode};

use axum::response::{IntoResponse, Response};

use serde::Deserialize;

const CONTACT: &str = "security_contact";

const POLICY: &str = "security_policy";

/// How far ahead `Expires` is: under a year (RFC 9116 §2.5.5).

const EXPIRES_MS: i64 = 360 * 24 * 60 * 60_000;

/// The saved contact and policy (empty when unset).

pub async fn settings(app: &Shared) -> (String, String) {

    let get = |k| async move { accounts::setting(&app.db, k).await.ok().flatten().unwrap_or_default() };

    (get(CONTACT).await, get(POLICY).await)

}

/// A contact as the file gives it: an email address becomes a `mailto:`

/// URI; an https or mailto URI is kept. `None` for anything else.

pub fn contact_uri(contact: &str) -> Option<String> {

    let c = contact.trim();

    if c.is_empty() || c.chars().any(|ch| ch.is_whitespace() || ch.is_control()) {

        return None;

    }

    if c.starts_with("https://") || c.starts_with("mailto:") {

        return Some(c.to_string());

    }

    let (user, domain) = c.split_once('@')?;

    (!user.is_empty() && domain.contains('.') && !domain.contains('@') && !c.contains(':')).then(|| format!("mailto:{c}"))

}

/// The file's text, for a contact and policy, at `now_ms`.

pub fn text(base_url: &str, contact: &str, policy: &str, now_ms: i64) -> Option<String> {

    let contact = contact_uri(contact)?;

    let expires = crate::render::time::rfc3339((now_ms + EXPIRES_MS) as u64);

    let base = base_url.trim_end_matches('/');

    let mut out = format!("Contact: {contact}\nExpires: {expires}\n");

    if !policy.trim().is_empty() {

        out.push_str(&format!("Policy: {}\n", policy.trim()));

    }

    out.push_str(&format!("Preferred-Languages: en\nCanonical: {base}/.well-known/security.txt\n"));

    Some(out)

}

/// `GET /.well-known/security.txt` and `/security.txt`.

pub async fn serve(State(app): State<Shared>) -> Response {

    let (contact, policy) = settings(&app).await;

    match text(app.config.base_url(), &contact, &policy, db::now_ms()) {

        Some(t) => ([(header::CONTENT_TYPE, "text/plain; charset=utf-8")], t).into_response(),

        None => (StatusCode::NOT_FOUND, "This hub has no security contact set.\n").into_response(),

    }

}

#[derive(Deserialize)]

pub struct SecurityForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    #[serde(default)]

    contact: String,

    #[serde(default)]

    policy: String,

}

/// `POST /admin/security`: the contact (an email address or https page)

/// and an optional https policy page; an empty contact takes the file down.

pub async fn save(State(app): State<Shared>, viewer: Viewer, Form(f): Form<SecurityForm>) -> Result<Page<super::admin::AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    let me = super::admin::require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let (contact, policy) = (f.contact.trim(), f.policy.trim());

    if !contact.is_empty() && contact_uri(contact).is_none() {

        return Err(Error::bad(shell, "The contact is an email address or an https:// page."));

    }

    if !policy.is_empty() && (!policy.starts_with("https://") || policy.chars().any(char::is_whitespace)) {

        return Err(Error::bad(shell, "The policy is an https:// page, or empty."));

    }

    let e = |e| Error::from_db(shell.clone(), e);

    accounts::set_setting(&app.db, CONTACT, contact).await.map_err(e)?;

    accounts::set_setting(&app.db, POLICY, policy).await.map_err(e)?;

    accounts::audit(&app.db, Some(&me), "admin.security_contact", contact, policy).await.ok();

    let notice = if contact.is_empty() {

        "No security contact: /.well-known/security.txt is gone.".to_string()

    } else {

        "Security contact saved: /.well-known/security.txt names it.".to_string()

    };

    super::admin::admin_page(&app, shell, Some(notice)).await

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn contacts_become_uris_or_are_refused() {

        assert_eq!(contact_uri("[email protected]").as_deref(), Some("mailto:[email protected]"));

        assert_eq!(contact_uri(" https://example.org/report ").as_deref(), Some("https://example.org/report"));

        assert_eq!(contact_uri("mailto:[email protected]").as_deref(), Some("mailto:[email protected]"));

        for bad in ["", "http://example.org", "nobody", "a@b", "a [email protected]", "javascript:alert(1)", "[email protected]\nContact: evil"] {

            assert_eq!(contact_uri(bad), None, "{bad:?}");

        }

    }

    #[test]

    fn the_file_expires_under_a_year_ahead_and_is_canonical() {

        let now = 1_800_000_000_000; // 2027-01-15

        let t = text("https://hub.example/", "[email protected]", "https://hub.example/policy", now).unwrap();

        assert_eq!(

            t,

            "Contact: mailto:[email protected]\nExpires: 2028-01-10T08:00:00Z\nPolicy: https://hub.example/policy\n\

             Preferred-Languages: en\nCanonical: https://hub.example/.well-known/security.txt\n"

        );

        assert!(!text("https://hub.example", "[email protected]", "", now).unwrap().contains("Policy"));

        assert!(text("https://hub.example", "", "", now).is_none());

    }

}

    /// The security.txt contact and policy (oxygenhub#224).

    security_contact: String,

    security_policy: String,

pub(super) fn require_admin(viewer: &Viewer, shell: &Shell) -> Result<accounts::Account, Error> {

pub(super) async fn admin_page(app: &Shared, shell: Shell, notice: Option<String>) -> Result<Page<AdminPage>, Error> {

    let (security_contact, security_policy) = super::security_txt::settings(app).await;

        security_contact,

        security_policy,

mod security_txt;

        .route("/.well-known/security.txt", get(security_txt::serve))

        .route("/security.txt", get(security_txt::serve))

        .route("/admin/security", post(security_txt::save))

#[tokio::test]

async fn security_txt_names_the_contact_an_administrator_sets() {

    let h = hub().await;

    let app = &h.app;

    assert_eq!(get(app, "/.well-known/security.txt", None).await.status, StatusCode::NOT_FOUND, "no contact, no file");

    let andy = register(app, "andy", "").await;

    let page = get(app, "/admin", Some(&andy)).await.body;

    assert!(page.contains("No contact yet"), "the panel");

    let csrf = csrf_of(&page);

    let set = |contact: &'static str, policy: &'static str| {

        let (andy, csrf) = (andy.clone(), csrf.clone());

        async move { post(app, "/admin/security", Some(&andy), &format!("_csrf={csrf}&contact={contact}&policy={policy}")).await }

    };

    assert_eq!(set("javascript%3Aalert(1)", "").await.status, StatusCode::BAD_REQUEST);

    assert_eq!(set("sec%40example.org", "http%3A%2F%2Fexample.org").await.status, StatusCode::BAD_REQUEST, "policy over https only");

    let r = set("sec%40example.org", "https%3A%2F%2Fexample.org%2Fpolicy").await;

    assert!(r.body.contains("Security contact saved"), "{}", r.body);

    for path in ["/.well-known/security.txt", "/security.txt"] {

        let r = get(app, path, None).await;

        assert_eq!(r.status, StatusCode::OK);

        assert!(r.body.starts_with("Contact: mailto:[email protected]\nExpires: 20"), "{}", r.body);

        assert!(r.body.contains("Policy: https://example.org/policy\n") && r.body.contains("/.well-known/security.txt\n"), "{}", r.body);

    }

    // Someone not an administrator cannot change it.

    let r = post(app, "/admin/invite", Some(&andy), &format!("_csrf={csrf}")).await;

    let code = r.body.split("register?invite=").nth(1).unwrap().split('<').next().unwrap().trim().to_string();

    let bob = register(app, "bob", &code).await;

    let r = post(app, "/admin/security", Some(&bob), &format!("_csrf={csrf}&contact=x%40evil.example")).await;

    assert_ne!(r.status, StatusCode::OK);

    // An empty contact takes the file down.

    set("", "").await;

    assert_eq!(get(app, "/security.txt", None).await.status, StatusCode::NOT_FOUND);

}

## security.txt (oxygenhub#224)

Administration › Security contact sets where vulnerabilities are reported

(an email address or an https page) and, optionally, a policy page. The

hub then serves `/.well-known/security.txt` (and `/security.txt`) per

RFC 9116, with an `Expires` date that is always just under a year ahead,

so it never goes stale. With no contact set, both answer 404.

  <a href="#security">Security contact</a>

<section class="panel" id="security">

  <h2>Security contact</h2>

  <form class="card" method="post" action="/admin/security">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label for="seccontact">Contact</label><input type="text" id="seccontact" name="contact" value="{{ security_contact }}" placeholder="[email protected] or https://example.org/report" autocomplete="off">

    <label for="secpolicy">Policy page</label><input type="url" id="secpolicy" name="policy" value="{{ security_policy }}" placeholder="https://example.org/security-policy (optional)" autocomplete="off">

    <button type="submit">SAVE</button>

  </form>

  <p class="small mute">{% if security_contact.is_empty() %}No contact yet, so there is no <code>security.txt</code>.{% else %}Published at <a href="/.well-known/security.txt">/.well-known/security.txt</a>.{% endif %} Researchers look there (RFC 9116) for where to report a vulnerability in this hub. Its expiry date renews itself.</p>

</section>