46 lines
1.8 KiB
TypeScript
46 lines
1.8 KiB
TypeScript
|
import { Capability, MatrixCapabilities } from 'matrix-widget-api';
|
||
|
|
|
||
|
|
// Conservative v1 capability policy: approve only benign display capabilities.
|
||
|
|
// Everything else (room-event send/receive, to-device, uploads, user-directory,
|
||
|
|
// delayed events, TURN servers) is denied — a random widget must not be able to
|
||
|
|
// act as the user or read room data without an explicit consent flow (follow-up).
|
||
|
|
export const ALLOWED_WIDGET_CAPABILITIES: ReadonlySet<Capability> = new Set<Capability>([
|
||
|
|
MatrixCapabilities.AlwaysOnScreen,
|
||
|
|
MatrixCapabilities.RequiresClient,
|
||
|
|
MatrixCapabilities.Screenshots,
|
||
|
|
]);
|
||
|
|
|
||
|
|
export const filterWidgetCapabilities = (requested: Set<Capability>): Set<Capability> =>
|
||
|
|
new Set([...requested].filter((cap) => ALLOWED_WIDGET_CAPABILITIES.has(cap)));
|
||
|
|
|
||
|
|
export type WidgetUrlError = 'empty' | 'invalid' | 'not-https' | 'same-origin';
|
||
|
|
|
||
|
|
// A widget URL to ADD must be https and NOT our own origin: a same-origin frame
|
||
|
|
// with allow-same-origin + allow-scripts can break out of the sandbox against us.
|
||
|
|
export const validateWidgetUrl = (raw: string, appOrigin: string): WidgetUrlError | undefined => {
|
||
|
|
const trimmed = raw.trim();
|
||
|
|
if (!trimmed) return 'empty';
|
||
|
|
let url: URL;
|
||
|
|
try {
|
||
|
|
url = new URL(trimmed);
|
||
|
|
} catch {
|
||
|
|
return 'invalid';
|
||
|
|
}
|
||
|
|
if (url.protocol !== 'https:') return 'not-https';
|
||
|
|
if (url.origin === appOrigin) return 'same-origin';
|
||
|
|
return undefined;
|
||
|
|
};
|
||
|
|
|
||
|
|
// Is an already-resolved (complete) widget URL safe to render in a sandboxed
|
||
|
|
// iframe that carries allow-same-origin? Rejects same-origin URLs (breakout).
|
||
|
|
export const isWidgetUrlSafe = (completeUrl: string, appOrigin: string): boolean => {
|
||
|
|
try {
|
||
|
|
return new URL(completeUrl).origin !== appOrigin;
|
||
|
|
} catch {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
export const generateWidgetId = (): string =>
|
||
|
|
`lotus_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
|