RocketChat / RocketChat/Rocket.Chat
Privacy issue in thumbnail loading behavior
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
The Rocket.Chat client currently loads thumbnails of image URLs directly from the host in the URL. I believe this is a serious privacy issue, as it allows malicious users to discover the IP address of any online user by sending them links to images on a server they control. In my view, this ought be remedied by letting the server fetch and proxy image thumbnails—many other chat/messaging applications already use this approach.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by tracing the Rocket.Chat client’s thumbnail-loading path and the server-side fetch/proxy behavior described in the issue; done means image thumbnails are fetched through the server rather than directly from the host, preventing the host from learning the user’s IP address.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100