fix(security): widget consents and shared files cleared on logout; forged shares refused (#266, #267)

#266: remembered widget approvals (lotus.widgetConsent.*) survived logout,
so they applied silently to the next account on the device and listed the
previous account's rooms; clearPlaintextCaches now sweeps them. Space
structure, call membership and Lotus room-policy state join
PROTECTED_STATE_TYPES, so no widget can be granted them.

#267: any website could auto-submit a form to /share-target and land the
user in the share picker with attacker-chosen text and files. The worker
now refuses a share whose Origin is another site. (Sec-Fetch-Site, as the
issue suggested, never reaches a service worker: checked in Chromium.)
Origin null/absent, as the OS share sheet sends, stays accepted, and
/share now says the content came from another app or website. Both logout
paths await clearSharedPayload(); the server-forced one also clears the
soundboard clip cache, as #57 intended.

Fixes #266
Fixes #267

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/features/room/widgets/widgetUtils.test.ts

@@ -106,3 +106,19 @@ test('classifyWidgetCapabilities: reading protected state is fine, changing unpr
 test('loadWidgetConsent tolerates missing storage', () => {
   assert.equal(loadWidgetConsent('!r:x', 'w', 'https://w.example'), undefined);
 });
+
+test('[#266] space structure, call membership and Lotus room policy can never be granted', () => {
+  const { auto, ask } = classifyWidgetCapabilities(
+    [
+      'm.space.child',
+      'm.space.parent',
+      'org.matrix.msc3401.call',
+      'org.matrix.msc3401.call.member',
+      'm.call.member',
+      'io.lotus.voice_limit',
+      'io.lotus.room_quality',
+    ].map((t) => `org.matrix.msc2762.send.state_event:${t}`),
+  );
+  assert.equal(auto.size, 0);
+  assert.deepEqual(ask, []);
+});

src/app/features/room/widgets/widgetUtils.ts

@@ -67,6 +67,16 @@ export const PROTECTED_STATE_TYPES: ReadonlySet<string> = new Set([
   'm.room.third_party_invite',
   'im.vector.modular.widgets',
   'm.widget',
+  // [Gitea #266] Space structure, call membership and Lotus room policy: a
+  // widget could restructure a space, fake call membership or lift the
+  // voice-channel limit, so these can't be granted even with consent.
+  'm.space.child',
+  'm.space.parent',
+  'org.matrix.msc3401.call',
+  'org.matrix.msc3401.call.member',
+  'm.call.member',
+  'io.lotus.voice_limit',
+  'io.lotus.room_quality',
 ]);
 
 export type WidgetPermissionRequest = {
@@ -137,8 +147,11 @@ export const classifyWidgetCapabilities = (
  */
 export type StoredWidgetConsent = { url: string; allowed: Capability[]; denied: Capability[] };
 
+// [Gitea #266] Swept on logout by clearPlaintextCaches, so one account's
+// approvals never apply to the next account on the same device.
+export const WIDGET_CONSENT_PREFIX = 'lotus.widgetConsent.';
 export const widgetConsentKey = (roomId: string, widgetId: string): string =>
-  `lotus.widgetConsent.${roomId}.${widgetId}`;
+  `${WIDGET_CONSENT_PREFIX}${roomId}.${widgetId}`;
 
 export const loadWidgetConsent = (
   roomId: string,

src/app/pages/client/ClientRoot.tsx

@@ -33,6 +33,8 @@ import {
 } from '../../../client/initMatrix';
 import { deleteSearchCacheDatabase } from '../../utils/searchCache';
 import { clearPlaintextCaches } from '../../state/plaintextCaches';
+import { clearSoundboardClipCache } from '../../utils/soundboardClips';
+import { clearSharedPayload } from '../../../swShare';
 import { SplashScreen } from '../../components/splash-screen';
 import { ServerConfigsLoader } from '../../components/ServerConfigsLoader';
 import { CapabilitiesProvider } from '../../hooks/useCapabilities';
@@ -172,6 +174,10 @@ const useLogoutListener = (mx?: MatrixClient) => {
       // (translation, scheduled messages, recent searches/forwards/gifs/
       // stickers, nav paths) — wipe them on server-forced logout too.
       clearPlaintextCaches(mx?.getUserId() ?? undefined);
+      // [Gitea #57] As on manual logout: no decrypted clip bytes via blob: URLs.
+      clearSoundboardClipCache();
+      // [Gitea #267] As on manual logout: drop files stashed by the share target.
+      await clearSharedPayload().catch(() => undefined);
       // Remove only the session credential keys — NOT settings, drafts, and
       // other preferences (N98). The SDK's IndexedDB stores are cleared above;
       // window.localStorage.clear() is reserved for the explicit reset path.

src/app/pages/client/share/Share.tsx

@@ -145,6 +145,11 @@ export function Share() {
               <Box direction="Column" gap="400">
                 <Box direction="Column" gap="200">
                   <Text size="L400">Shared</Text>
+                  {/* [Gitea #267] Not everything that arrives here came from the
+                      user's share sheet; say so before they pick a room. */}
+                  <Text size="T200" priority="300">
+                    This came from another app or website. Check it before you send it.
+                  </Text>
                   {shared.files.map((f) => (
                     <Box key={f.name} alignItems="Center" gap="200">
                       <Icon

src/app/state/plaintextCaches.test.ts

@@ -26,7 +26,10 @@ const api = {
       : Object.getOwnPropertyDescriptor(target, key),
 });
 
-const { clearPlaintextCaches, plaintextCachesWiped } = await import('./plaintextCaches');
+const { clearPlaintextCaches, plaintextCachesWiped, WIDGET_CONSENT_KEY_PREFIX } =
+  await import('./plaintextCaches');
+const { WIDGET_CONSENT_PREFIX, widgetConsentKey } =
+  await import('../features/room/widgets/widgetUtils');
 
 test('clearPlaintextCaches removes every plaintext/PII localStorage key', () => {
   store.clear();
@@ -104,3 +107,17 @@ test('clearPlaintextCaches clears the encrypted-search opt-in and flags the wipe
   assert.equal(store.has('mxjssdk_memory_filter_FILTER_SYNC_@me:server'), false);
   assert.equal(plaintextCachesWiped(), true, 'draft writes stop until the page reloads');
 });
+
+test('[#266] clearPlaintextCaches sweeps remembered widget approvals', () => {
+  assert.equal(WIDGET_CONSENT_KEY_PREFIX, WIDGET_CONSENT_PREFIX, 'prefix kept in sync');
+  store.clear();
+  const consent = widgetConsentKey('!room:server', 'widget-1');
+  store.set(consent, '{"url":"https://pad.example","allowed":[],"denied":[]}');
+  store.set('lotus.widgetConsentNotAKey', 'kept');
+  removed.length = 0;
+
+  clearPlaintextCaches('@me:server');
+
+  assert.ok(removed.includes(consent), 'consent cleared');
+  assert.ok(store.has('lotus.widgetConsentNotAKey'), 'unrelated key kept');
+});

src/app/state/plaintextCaches.ts

@@ -139,6 +139,31 @@ const clearAccountScopedFlags = (userId?: string): void => {
   });
 };
 
+/**
+ * [Gitea #266] Remembered widget approvals (`lotus.widgetConsent.<room>.<widget>`,
+ * widgetUtils.ts) would otherwise apply silently to the next account on this
+ * device, and their keys list the previous account's rooms. Kept as a string
+ * here so logout doesn't pull the widget code into the entry chunk; a test
+ * checks it matches WIDGET_CONSENT_PREFIX.
+ */
+export const WIDGET_CONSENT_KEY_PREFIX = 'lotus.widgetConsent.';
+const clearWidgetConsents = (): void => {
+  let keys: string[];
+  try {
+    keys = Object.keys(localStorage);
+  } catch {
+    return;
+  }
+  keys.forEach((key) => {
+    if (!key.startsWith(WIDGET_CONSENT_KEY_PREFIX)) return;
+    try {
+      localStorage.removeItem(key);
+    } catch {
+      // best-effort
+    }
+  });
+};
+
 export const clearPlaintextCaches = (userId?: string): void => {
   wiped = true;
   clearTranslationCache();
@@ -153,5 +178,6 @@ export const clearPlaintextCaches = (userId?: string): void => {
   clearStatusMessage();
   clearCallVolumesAndSyncMeta(userId);
   clearAccountScopedFlags(userId);
+  clearWidgetConsents();
   if (userId) clearNavToActivePathStore(userId);
 };