element-hq / element-hq/element-web
Put internal widgets on their own domain in the desktop app
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
We could serve the internal jitsi widget from somewhere like `vector://jitsi.widget/` in the desktop app which would isolate it from the rest of the app, making the desktop app immune from the kind of XSS that happened in 1.5.14.
However the jitsi widget is currently mixed in with the rest of Riot's files so we would have to manually whitelist the separate files to be served from the other domain, which will inevitably lead to the jitsi widget being broken in desktop when another file is added and we forget to add it to the list in desktop.
To do this we'd need to move all the jitsi widget files into their own directory, but this would affect web too, breaking the URLs for widgets already out there which would break any clients using those widgets as v1 widgets.
We either 1. do this asap and hope the number of widgets out there using /jitsi.html is relatively small, 2. wait until nothing uses the url anyway, and/or 3. make jitsi.html do a javascript redirect to the right place.
Contributor guide
Assessment
This issue has not been assessed yet.