The desktop CSP's frame-src listed only known embed hosts (YouTube, Vimeo, Spotify, …) plus the call page. Every room widget outside that list (Jitsi, Etherpad, Grafana, Hookshot, custom bots) was blocked and showed a blank frame. The web deploy has allowed https: frames since #205.
Change:frame-src 'self' blob: http://127.0.0.1:44548 https:. This keeps the loopback call page, drops the per-provider list (which https: covers), and matches the web.
Why it's safe:
cinny renders widgets in a sandboxed iframe (RoomWidgetView).
isWidgetUrlSafe refuses same-origin widget URLs, so a widget can't run as the app.
Other directives are unchanged; http: frames are still not allowed.
Not verified in a built app. I didn't build the Tauri app here. The change is one directive, and the JSON was checked to parse. Worth a check on the next nightly: Widgets → a https://meet.jit.si/… widget should load.
Fixes #33.
The desktop CSP's `frame-src` listed only known embed hosts (YouTube, Vimeo, Spotify, …) plus the call page. Every **room widget** outside that list (Jitsi, Etherpad, Grafana, Hookshot, custom bots) was blocked and showed a blank frame. The web deploy has allowed `https:` frames since #205.
**Change:** `frame-src 'self' blob: http://127.0.0.1:44548 https:`. This keeps the loopback call page, drops the per-provider list (which `https:` covers), and matches the web.
**Why it's safe:**
- cinny renders widgets in a **sandboxed** iframe (`RoomWidgetView`).
- `isWidgetUrlSafe` refuses same-origin widget URLs, so a widget can't run as the app.
- Other directives are unchanged; `http:` frames are still not allowed.
**Not verified in a built app.** I didn't build the Tauri app here. The change is one directive, and the JSON was checked to parse. Worth a check on the next nightly: Widgets → a `https://meet.jit.si/…` widget should load.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
The desktop CSP listed only known embed hosts in frame-src, so every
room widget that is not one of them (Jitsi, Etherpad, Grafana, bots)
showed a blank frame; the web deploy allows https: frames (#205).
Match it. Widget frames are sandboxed by cinny and same-origin widget
URLs are refused (isWidgetUrlSafe), so this does not widen what a
widget can do to the app.
Fixes#33
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared
merged commit 50f57bedc8 into main2026-10-18 19:44:49 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #33.
The desktop CSP's
frame-srclisted only known embed hosts (YouTube, Vimeo, Spotify, …) plus the call page. Every room widget outside that list (Jitsi, Etherpad, Grafana, Hookshot, custom bots) was blocked and showed a blank frame. The web deploy has allowedhttps:frames since #205.Change:
frame-src 'self' blob: http://127.0.0.1:44548 https:. This keeps the loopback call page, drops the per-provider list (whichhttps:covers), and matches the web.Why it's safe:
RoomWidgetView).isWidgetUrlSaferefuses same-origin widget URLs, so a widget can't run as the app.http:frames are still not allowed.Not verified in a built app. I didn't build the Tauri app here. The change is one directive, and the JSON was checked to parse. Worth a check on the next nightly: Widgets → a
https://meet.jit.si/…widget should load.🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5