fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326)

The embed fallback used the preview's og:url whatever site was posted.
og:url is set by the page, so evil.example could render as a playable
YouTube card (attacker's video) whose links go to evil.example. Only use
an og:url on the same provider as the posted link, including the
provider's own short-link domains (youtu.be, spotify.link, redd.it, …).

Fixes #326

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.22",
+      "version": "0.25.0-lotus.23",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.22/element-call-embedded-0.25.0-lotus.22.tgz",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.23/element-call-embedded-0.25.0-lotus.23.tgz",
-      "integrity": "sha512-AimDKZA4xUKEEyl2XUFUSUDl03tBKFv88T/3igKyH2VqNSPMGnqcQJC5HXIkHLTWrOmg8kLcJ//FFbqlUZiLcA==",
+      "integrity": "sha512-vRmcWeJcU0Accyl2x3mqNEzrIe8djE5BekyYbYOSCsMflC98rZgD1mO7KOe7bA1cX7gparRf6sAt1fotHoU+bA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/components/create-room/utils.ts

@@ -139,8 +139,11 @@ export const createRoom = async (mx: MatrixClient, data: CreateRoomData): Promis
       data.allowFederation,
       data.additionalCreators,
     ),
-    power_level_content_override:
+    // [Gitea #328] Every non-space room gets call.member at user level, not just
-      data.type === RoomType.Call ? createVoiceRoomPowerLevelsOverride() : undefined,
+    // voice rooms: the call button is shown in private group rooms too, and with
+    // Synapse's state_default (50) only admins could start or join a call there
+    // ("You don't have permission to join!").
+    power_level_content_override: createVoiceRoomPowerLevelsOverride(),
     initial_state: initialState,
   };
 

src/app/components/url-preview/UrlPreviewCard.tsx

@@ -54,6 +54,7 @@ import {
   GIF_PREVIEW_MAX_WIDTH,
   gifPreviewBox,
 } from '../../utils/gifPreviewSize';
+import { sameProvider } from './embedProvider';
 
 const linkStyles = { color: color.Success.Main };
 
@@ -2497,7 +2498,10 @@ export const UrlPreviewCard = as<'div', { url: string; ts: number }>(
     const resolveEmbed = (prev: IPreviewUrlResponse): MediaEmbed | null => {
       if (embed) return embed;
       const ogUrl = prev['og:url'];
-      return typeof ogUrl === 'string' && ogUrl !== url
+      // [Gitea #326] …but only from an og:url on the posted link's own
+      // provider: the page sets og:url, so any site could otherwise show up
+      // as a playable YouTube (etc.) card that links to itself.
+      return typeof ogUrl === 'string' && ogUrl !== url && sameProvider(url, ogUrl)
         ? parseMediaEmbed(ogUrl, window.location.hostname)
         : null;
     };

src/app/components/url-preview/embedProvider.test.ts

@@ -0,0 +1,22 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sameProvider } from './embedProvider';
+
+test("sameProvider: a page cannot borrow another provider's embed via og:url (#326)", () => {
+  const yt = 'https://www.youtube.com/watch?v=dQw4w9WgXcQ';
+  assert.equal(sameProvider('https://evil.example/free-gift', yt), false);
+  assert.equal(sameProvider('https://youtube.com.evil.example/x', yt), false);
+  assert.equal(sameProvider('https://youtu.be/abc', yt), true);
+  assert.equal(sameProvider('https://m.youtube.com/shorts/abc', yt), true);
+  assert.equal(
+    sameProvider('https://vm.tiktok.com/ZM123/', 'https://www.tiktok.com/@a/video/1'),
+    true,
+  );
+  assert.equal(sameProvider('https://spotify.link/abc', 'https://open.spotify.com/track/1'), true);
+  assert.equal(sameProvider('https://on.soundcloud.com/x', 'https://soundcloud.com/a/b'), true);
+  assert.equal(
+    sameProvider('https://redd.it/abc', 'https://www.reddit.com/r/x/comments/abc/'),
+    true,
+  );
+  assert.equal(sameProvider('not a url', yt), false);
+});

src/app/components/url-preview/embedProvider.ts

@@ -0,0 +1,36 @@
+/**
+ * [Gitea #326] A page's og:url is chosen by the page itself, so a phishing
+ * link could serve `og:url = youtube.com/watch?v=…` and render as a playable
+ * YouTube card linking to the attacker. Only trust an og:url on the same
+ * provider as the link actually posted (including the provider's own
+ * short-link domains).
+ */
+const PROVIDER_ALIASES: Record<string, string> = {
+  'youtu.be': 'youtube.com',
+  'youtube-nocookie.com': 'youtube.com',
+  'spotify.link': 'spotify.com',
+  'redd.it': 'reddit.com',
+  'x.com': 'twitter.com',
+  'twitch.tv': 'twitch.tv',
+  'apple.co': 'apple.com',
+};
+
+/**
+ * Pure: the provider a host belongs to (last two labels, aliases folded). Hosts
+ * under two-part public suffixes (`*.co.uk`) share a value, which is harmless
+ * here: no embeddable provider lives under one.
+ */
+export const providerOf = (host: string): string => {
+  const parts = host.toLowerCase().replace(/\.$/, '').split('.');
+  const base = parts.slice(-2).join('.');
+  return PROVIDER_ALIASES[base] ?? base;
+};
+
+/** Pure: whether `ogUrl` is on the same provider as the posted `url`. */
+export function sameProvider(url: string, ogUrl: string): boolean {
+  try {
+    return providerOf(new URL(url).hostname) === providerOf(new URL(ogUrl).hostname);
+  } catch {
+    return false;
+  }
+}

src/app/features/room/message/Reactions.tsx

@@ -69,8 +69,15 @@ export const Reactions = as<'div', ReactionsProps>(
     const measure = useCallback(() => {
       const container = containerRef.current;
       if (!container) return;
-      const rowWidth = container.getBoundingClientRect().width;
+      // [Gitea #305] The width the chips actually get (content box). The border
-      const gap = parseFloat(getComputedStyle(container).columnGap) || 8;
+      // box grows by 4 px while collapsed (margin -2 / padding 2), and measuring
+      // it made a row within 4 px of fitting flip collapsed↔expanded every frame.
+      const cs = getComputedStyle(container);
+      const rowWidth =
+        container.clientWidth -
+        (parseFloat(cs.paddingLeft) || 0) -
+        (parseFloat(cs.paddingRight) || 0);
+      const gap = parseFloat(cs.columnGap) || 8;
       const chips = keys ? keys.split('\u0000').map((k) => chipRefs.current.get(k)) : [];
       const widths = chips.map((el) => el?.getBoundingClientRect().width ?? 0);
       const moreWidth = moreRef.current?.getBoundingClientRect().width ?? 48;
@@ -110,8 +117,21 @@ export const Reactions = as<'div', ReactionsProps>(
         style={{
           ...props.style,
           ...(collapsed && rowHeight
-            ? // 2px breathing room so row-1 focus outlines are not clipped.
+            ? // 2px breathing room so row-1 focus outlines are not clipped. Longhand
-              { maxHeight: rowHeight + 4, overflow: 'hidden', padding: 2, margin: -2 }
+              // margins so the timeline's marginTop survives (Gitea #305: the
+              // `margin` shorthand overrode it and, once removed, cleared it).
+              {
+                maxHeight: rowHeight + 4,
+                overflow: 'hidden',
+                padding: 2,
+                marginLeft: -2,
+                marginRight: -2,
+                marginBottom: -2,
+                marginTop:
+                  props.style?.marginTop !== undefined
+                    ? `calc(${typeof props.style.marginTop === 'number' ? `${props.style.marginTop}px` : props.style.marginTop} - 2px)`
+                    : -2,
+              }
             : {}),
         }}
         ref={(el) => {

src/app/plugins/call/CallEmbed.ts

@@ -31,6 +31,7 @@ import { verifyDenoiseAssets } from './denoiseSmokeCheck';
 import { canDelegateCapability } from './utils';
 import { getCallPageUrl } from './callPageUrl';
 import { restrictWidgetMessages } from '../widgetTransport';
+import { isRingableRoom } from '../../utils/callRing';
 
 // Maximum time to wait for the embedded Element Call iframe to progress from
 // initial load to a ready/joined state. If it hasn't by then, we assume the
@@ -251,8 +252,18 @@ export class CallEmbed {
       verifyDenoiseAssets(denoiseModel).catch(() => undefined);
     }
 
+    // [Gitea #295] Only ask Element Call to notify where a call can ring at all
+    // (DMs, invite-only groups outside a space). In a voice channel or space
+    // room the notification carries an @room mention, so every member got a
+    // highlighted ping (and phone push) whenever a moderator hopped in, and
+    // other clients showed it as a missed call.
+    // `none` needs element-call-embedded ≥ 0.25.0-lotus.23 (older builds ignore it).
     if (CallEmbed.startingCall(intent)) {
-      params.append('sendNotificationType', CallEmbed.dmCall(intent) ? 'ring' : 'notification');
+      let notify = 'none';
+      if (isRingableRoom(room, CallEmbed.dmCall(intent))) {
+        notify = CallEmbed.dmCall(intent) ? 'ring' : 'notification';
+      }
+      params.append('sendNotificationType', notify);
     }
 
     // [Gitea #43] On its own origin when config.json sets elementCallUrl.