element-hq / element-hq/element-web

Put internal widgets on their own domain in the desktop app

Open
#32,348 5 comments 1 reaction 0 assignees View on GitHub
A-Electron A-Jitsi O-Uncommon T-Feature
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

We could serve the internal jitsi widget from somewhere like `vector://jitsi.widget/` in the desktop app which would isolate it from the rest of the app, making the desktop app immune from the kind of XSS that happened in 1.5.14.

However the jitsi widget is currently mixed in with the rest of Riot's files so we would have to manually whitelist the separate files to be served from the other domain, which will inevitably lead to the jitsi widget being broken in desktop when another file is added and we forget to add it to the list in desktop.

To do this we'd need to move all the jitsi widget files into their own directory, but this would affect web too, breaking the URLs for widgets already out there which would break any clients using those widgets as v1 widgets.

We either 1. do this asap and hope the number of widgets out there using /jitsi.html is relatively small, 2. wait until nothing uses the url anyway, and/or 3. make jitsi.html do a javascript redirect to the right place.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.