Desktop CSP frame-src blocks room widgets (Jitsi, Etherpad, …); web allows them #33

New Issue

2026-10-04T17:41:27-04:00

jared commented

2026-10-04 17:41:27 -04:00

What happens
Room widgets (cinny's Widgets panel, MSC1236) load the widget URL in an iframe (cinny src/app/features/room/widgets/RoomWidgetView.tsx:63). The web deploy allows that with frame-src 'self' https: (matrix cinny/nginx-security-headers.conf:15, widened for #205).

The desktop app's CSP (src-tauri/tauri.conf.json → app.security.csp) only allows a fixed list of embed hosts (YouTube, Vimeo, Spotify, …) plus the call page. So every widget that isn't one of those embed hosts is blocked on desktop: Jitsi, Etherpad, Grafana, custom bots. The panel shows a blank frame.

Verified in the Linux nightly 4.12.377 under WebDriver: an iframe to https://meet.jit.si/… fires securitypolicyviolation: frame-src https://meet.jit.si, while https://www.youtube-nocookie.com/embed/… loads.

Fix ideas

Add https: to the desktop frame-src. Widgets are already sandboxed, and same-origin widget URLs are refused in validateWidgetUrl / isWidgetUrlSafe.
Or have the Widgets panel show a clear "not supported in the desktop app" message instead of a blank frame.

More context

Introduced by: the desktop CSP tightening in cinny-desktop 706b025 (2026-07-02), followed by per-provider frame-src additions for embeds (3af0449…5879193). Room widgets (cinny c1661e48 / 43f4ceb4) were never added. The web deploy widened frame-src to https: for #205.

Who: desktop app users (Windows and Linux) in rooms with widgets: Jitsi, Etherpad, Grafana, Hookshot widgets, custom bots.

Manual repro

In the web app, add a widget with https://meet.jit.si/lotus-test to a room.
Open that room in the desktop app → Widgets.
Actual: blank frame (the console shows a CSP frame-src violation). Expected: the widget loads, as on web.

Acceptance criteria: a non-allow-listed https widget renders in the desktop build; the Windows smoke test (scripts/windows-smoke.mjs) gains a "widget iframe loads" check.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

**What happens** Room widgets (cinny's Widgets panel, MSC1236) load the widget URL in an iframe (cinny `src/app/features/room/widgets/RoomWidgetView.tsx:63`). The web deploy allows that with `frame-src 'self' https:` (matrix `cinny/nginx-security-headers.conf:15`, widened for #205). The desktop app's CSP (`src-tauri/tauri.conf.json` → `app.security.csp`) only allows a fixed list of embed hosts (YouTube, Vimeo, Spotify, …) plus the call page. So **every widget that isn't one of those embed hosts is blocked on desktop**: Jitsi, Etherpad, Grafana, custom bots. The panel shows a blank frame. **Verified** in the Linux nightly 4.12.377 under WebDriver: an iframe to `https://meet.jit.si/…` fires `securitypolicyviolation: frame-src https://meet.jit.si`, while `https://www.youtube-nocookie.com/embed/…` loads. **Fix ideas** - Add `https:` to the desktop `frame-src`. Widgets are already sandboxed, and same-origin widget URLs are refused in `validateWidgetUrl` / `isWidgetUrlSafe`. - Or have the Widgets panel show a clear "not supported in the desktop app" message instead of a blank frame. ### More context **Introduced by:** the desktop CSP tightening in cinny-desktop 706b025 (2026-07-02), followed by per-provider `frame-src` additions for embeds (3af0449…5879193). Room widgets (cinny c1661e48 / 43f4ceb4) were never added. The web deploy widened `frame-src` to `https:` for #205. **Who:** desktop app users (Windows and Linux) in rooms with widgets: Jitsi, Etherpad, Grafana, Hookshot widgets, custom bots. **Manual repro** 1. In the web app, add a widget with `https://meet.jit.si/lotus-test` to a room. 2. Open that room in the desktop app → Widgets. 3. **Actual:** blank frame (the console shows a CSP `frame-src` violation). **Expected:** the widget loads, as on web. **Acceptance criteria:** a non-allow-listed https widget renders in the desktop build; the Windows smoke test (`scripts/windows-smoke.mjs`) gains a "widget iframe loads" check. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._