fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286)

Previews are built from the plain body, clicks follow formatted_body's
hrefs, and a sender controls both: text "https://paypal.com" linked to
evil.example showed a real PayPal card. Drop body URLs whose site is
only claimed by the visible text of a mismatched link (linkSafety).

Fixes #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/components/message/MsgTypeRenderers.tsx

@@ -40,6 +40,7 @@ import { parseGeoUri, scaleYDimension } from '../../utils/common';
 import { formatAccuracy } from '../../utils/geoShare';
 import { Attachment, AttachmentBox, AttachmentContent, AttachmentHeader } from './attachment';
 import { FileHeader, FileDownloadButton } from './FileHeader';
+import { previewUrlsFor } from '../../utils/linkSafety';
 
 // ≈ 20 lines; in rem so a larger font setting doesn't show fewer lines (Gitea #343).
 const COLLAPSE_MAX_HEIGHT_REM = 20;
@@ -343,7 +344,13 @@ export function MText({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -401,7 +408,13 @@ export function MEmote({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -458,7 +471,13 @@ export function MNotice({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>

src/app/plugins/call/CallEmbed.ts

@@ -218,9 +218,6 @@ export class CallEmbed {
       //  - transparent background so the room wallpaper shows through natively
       lotusCallState: 'true',
       lotusTransparent: 'true',
-      // [Gitea #293] the fork applies the theme with transparency anyway, and
-      // warned in every call that lotusTheme wasn't set
-      lotusTheme: 'true',
       // [Gitea #43] The fork hides its own footer (we draw the call bar) and
       // sets its root color-scheme from the theme, instead of us injecting CSS.
       lotusHostControls: 'true',

src/app/utils/linkSafety.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { analyzeLink, hostFromText, registrableDomain } from './linkSafety';
+import { analyzeLink, hostFromText, previewUrlsFor, registrableDomain } from './linkSafety';
 
 test('visible text that names another site is a mismatch', () => {
   const r = analyzeLink('https://matrix.lotusguild.org/login', 'https://evil.example/login');
@@ -73,3 +73,25 @@ test('shared hosting suffixes are separate sites (#335)', () => {
   );
   assert.equal(registrableDomain('news.bbc.co.uk'), 'bbc.co.uk');
 });
+
+test('previewUrlsFor: no preview for a site a deceptive link only claims (#286)', () => {
+  const urls = ['https://paypal.com'];
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://evil.example/login">https://paypal.com</a>'),
+    [],
+  );
+  // An honest link keeps its preview.
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://www.paypal.com/x">https://paypal.com</a>'),
+    urls,
+  );
+  assert.deepEqual(previewUrlsFor(urls, undefined), urls);
+  // Other links in the message keep theirs.
+  assert.deepEqual(
+    previewUrlsFor(
+      ['https://paypal.com', 'https://lotusguild.org'],
+      'see <a href="https://evil.example">paypal.com</a> and https://lotusguild.org',
+    ),
+    ['https://lotusguild.org'],
+  );
+});

src/app/utils/linkSafety.ts

@@ -221,3 +221,37 @@ export const analyzeLink = (text: string, href: string): LinkSafety | null => {
   const other = shown.find((h) => registrableDomain(h) !== realSite);
   return { mismatch: other !== undefined, shownHost: other ?? shown[0], realHost, punycode };
 };
+
+const ANCHOR_REG = /<a\s[^>]*href\s*=\s*(["'])(.*?)\1[^>]*>([\s\S]*?)<\/a>/gi;
+const decodeEntities = (s: string): string =>
+  s
+    .replace(/<[^>]+>/g, '')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+
+/**
+ * [Gitea #286] The URLs to build link previews for. Previews come from the
+ * plain `body`, but clicks follow `formatted_body`'s hrefs, and a sender
+ * controls both: text reading "https://paypal.com" linked to evil.example got
+ * a genuine PayPal card. Drop any body URL whose site is only *claimed* by a
+ * deceptive link's text.
+ */
+export const previewUrlsFor = (urls: string[], formattedBody: string | undefined): string[] => {
+  if (!formattedBody || urls.length === 0) return urls;
+  const claimed = new Set<string>();
+  Array.from(formattedBody.matchAll(ANCHOR_REG)).forEach((m) => {
+    const safety = analyzeLink(decodeEntities(m[3]), decodeEntities(m[2]));
+    if (safety?.mismatch && safety.shownHost) claimed.add(registrableDomain(safety.shownHost));
+  });
+  if (claimed.size === 0) return urls;
+  return urls.filter((u) => {
+    try {
+      return !claimed.has(registrableDomain(new URL(u).hostname));
+    } catch {
+      return true;
+    }
+  });
+};

vite.config.js

@@ -87,106 +87,97 @@ function copyPdfWorker() {
   };
 }
 
-// The denoise assets the fork loads from ./denoise/ at runtime, as
-// [source, path under denoise/] pairs; `dir: true` entries are whole trees.
-// Shared by the build copy and the dev server (Gitea #293).
-function denoiseSources() {
-  const sapphi = path.resolve('node_modules/@sapphi-red/web-noise-suppressor/dist');
-  const dfnVendor = path.resolve('build/denoise-vendor/deepfilternet');
-  return {
-    // All bundled denoise assets are REQUIRED: every entry backs a model the
-    // UI can select (RNNoise, Speex) or the optional noise gate.
-    sapphi: [
-      [path.join(sapphi, 'rnnoise/workletProcessor.js'), 'rnnoiseWorklet.js'],
-      [path.join(sapphi, 'rnnoise.wasm'), 'rnnoise.wasm'],
-      [path.join(sapphi, 'rnnoise_simd.wasm'), 'rnnoise_simd.wasm'],
-      [path.join(sapphi, 'speex/workletProcessor.js'), 'speexWorklet.js'],
-      [path.join(sapphi, 'speex.wasm'), 'speex.wasm'],
-      [path.join(sapphi, 'noiseGate/workletProcessor.js'), 'noiseGateWorklet.js'],
-    ],
-    // DTLN (@workadventure/noise-suppression): a self-contained ES module that
-    // resolves its own worklet, LiteRT WASM runtime and TFLite models via
-    // `import.meta.url`, so its whole dist/ tree is served intact.
-    dtln: [path.resolve('node_modules/@workadventure/noise-suppression/dist'), 'workadventure'],
-    // DeepFilterNet 3: the ESM (worklet inlined) plus the vendored wasm and ONNX
-    // model (CDN-free / Tauri-CSP safe), in the package's expected v2/ layout.
-    dfn: [
-      [
-        path.resolve('node_modules/deepfilternet3-noise-filter/dist/index.esm.js'),
-        'deepfilternet/index.esm.js',
-      ],
-      [path.join(dfnVendor, 'v2/pkg/df_bg.wasm'), 'deepfilternet/v2/pkg/df_bg.wasm'],
-      [
-        path.join(dfnVendor, 'v2/models/DeepFilterNet3_onnx.tar.gz'),
-        'deepfilternet/v2/models/DeepFilterNet3_onnx.tar.gz',
-      ],
-    ],
-  };
-}
-
-// Lotus ML noise suppression: ship the denoise worklets/wasm/models alongside
-// the vendored Element Call bundle. Runs after viteStaticCopy has populated
-// dist/public/element-call (closeBundle order). [Gitea #293] The dev server
-// serves the same files at the same URLs, so `npm start` can test denoise.
+// Lotus ML noise suppression: ship the RNNoise worklet/wasm + our getUserMedia
+// shim alongside the vendored Element Call bundle, and inject the shim <script>
+// into EC's index.html so it runs before EC captures the mic. Runs after
+// viteStaticCopy has populated dist/public/element-call (closeBundle order).
 function lotusDenoise() {
-  const DEV_PREFIX = '/public/element-call/denoise/';
   return {
     name: 'lotus-denoise',
-    configureServer(server) {
-      const { sapphi, dtln, dfn } = denoiseSources();
-      const files = new Map([...sapphi, ...dfn].map(([src, rel]) => [rel, src]));
-      const types = { '.js': 'text/javascript', '.wasm': 'application/wasm' };
-      server.middlewares.use((req, res, next) => {
-        const url = (req.url ?? '').split('?')[0];
-        if (!url.startsWith(DEV_PREFIX)) return next();
-        const rel = decodeURIComponent(url.slice(DEV_PREFIX.length));
-        let file = files.get(rel);
-        if (!file && rel.startsWith(`${dtln[1]}/`)) {
-          const candidate = path.resolve(dtln[0], rel.slice(dtln[1].length + 1));
-          if (candidate.startsWith(dtln[0] + path.sep)) file = candidate;
-        }
-        if (!file || !fs.existsSync(file)) return next();
-        res.setHeader('Content-Type', types[path.extname(file)] ?? 'application/octet-stream');
-        fs.createReadStream(file).pipe(res);
-        return undefined;
-      });
-    },
     closeBundle() {
       const ecDir = path.resolve('dist/public/element-call');
       if (!fs.existsSync(ecDir)) return;
 
       const denoiseDir = path.join(ecDir, 'denoise');
       fs.mkdirSync(denoiseDir, { recursive: true });
-      const { sapphi, dtln, dfn } = denoiseSources();
 
-      // A missing source means a partial/changed install would otherwise
-      // silently ship a broken ML feature (worklet 404 -> raw mic), so we fail
-      // the build instead.
-      const missing = sapphi.filter(([s]) => !fs.existsSync(s)).map(([s]) => s);
+      const sapphi = path.resolve('node_modules/@sapphi-red/web-noise-suppressor/dist');
+      // All bundled denoise assets are REQUIRED: every entry backs a model the
+      // UI can select (RNNoise, Speex) or the optional noise gate. A missing
+      // source means a partial/changed install would otherwise silently ship a
+      // broken ML feature (worklet 404 -> raw mic), so we fail the build instead.
+      const assets = [
+        [
+          path.join(sapphi, 'rnnoise/workletProcessor.js'),
+          path.join(denoiseDir, 'rnnoiseWorklet.js'),
+        ],
+        [path.join(sapphi, 'rnnoise.wasm'), path.join(denoiseDir, 'rnnoise.wasm')],
+        [path.join(sapphi, 'rnnoise_simd.wasm'), path.join(denoiseDir, 'rnnoise_simd.wasm')],
+        [path.join(sapphi, 'speex/workletProcessor.js'), path.join(denoiseDir, 'speexWorklet.js')],
+        [path.join(sapphi, 'speex.wasm'), path.join(denoiseDir, 'speex.wasm')],
+        [
+          path.join(sapphi, 'noiseGate/workletProcessor.js'),
+          path.join(denoiseDir, 'noiseGateWorklet.js'),
+        ],
+      ];
+      const missing = assets.filter(([s]) => !fs.existsSync(s)).map(([s]) => s);
       if (missing.length > 0) {
         throw new Error(
           `[lotus-denoise] Required denoise asset(s) missing — build aborted to avoid shipping a broken ML feature:\n  ${missing.join('\n  ')}`,
         );
       }
-      sapphi.forEach(([s, rel]) => fs.copyFileSync(s, path.join(denoiseDir, rel)));
+      assets.forEach(([s, d]) => fs.copyFileSync(s, d));
 
-      const dtlnEntry = path.join(dtln[0], 'audio-worklet.js');
+      // DTLN (@workadventure/noise-suppression): unlike the flat sapphi
+      // worklets, this package is a self-contained ES module that resolves its
+      // own AudioWorklet processor, LiteRT WASM runtime and TFLite models via
+      // `import.meta.url`. So we copy its whole dist/ tree intact to
+      // denoise/workadventure/ (preserving assets/ + vendor/) and let the shim
+      // dynamic-import denoise/workadventure/audio-worklet.js at runtime. The
+      // entry module is required — fail the build if the install is broken.
+      const dtlnSrc = path.resolve('node_modules/@workadventure/noise-suppression/dist');
+      const dtlnEntry = path.join(dtlnSrc, 'audio-worklet.js');
       if (!fs.existsSync(dtlnEntry)) {
         throw new Error(
           `[lotus-denoise] DTLN entry missing (${dtlnEntry}) — build aborted. ` +
             'Run `npm ci` to install @workadventure/noise-suppression.',
         );
       }
-      fs.cpSync(dtln[0], path.join(denoiseDir, dtln[1]), { recursive: true });
+      fs.cpSync(dtlnSrc, path.join(denoiseDir, 'workadventure'), { recursive: true });
 
-      const dfnMissing = dfn.filter(([s]) => !fs.existsSync(s)).map(([s]) => s);
+      // DeepFilterNet 3 (deepfilternet3-noise-filter): the npm package ships only
+      // its ESM (index.esm.js) with the AudioWorklet processor + wasm-bindgen glue
+      // INLINED as a string (loaded via a Blob URL, no CDN for the worklet). The
+      // only runtime CDN fetches are its single-threaded `df_bg.wasm` and the
+      // ONNX `DeepFilterNet3_onnx.tar.gz` model — which we VENDOR locally (under
+      // build/denoise-vendor/deepfilternet/) and serve, overriding the package's
+      // cdnUrl to our self-hosted base. This keeps the feature CDN-free / Tauri-CSP
+      // safe. We copy the ESM (the shim dynamic-imports it, mirroring DTLN) plus
+      // the vendored assets, preserving the package's expected v2/... layout. All
+      // are required — a missing entry means a broken install, so fail the build.
+      const dfnEsm = path.resolve('node_modules/deepfilternet3-noise-filter/dist/index.esm.js');
+      const dfnVendor = path.resolve('build/denoise-vendor/deepfilternet');
+      const dfnAssets = [
+        [dfnEsm, path.join(denoiseDir, 'deepfilternet/index.esm.js')],
+        [
+          path.join(dfnVendor, 'v2/pkg/df_bg.wasm'),
+          path.join(denoiseDir, 'deepfilternet/v2/pkg/df_bg.wasm'),
+        ],
+        [
+          path.join(dfnVendor, 'v2/models/DeepFilterNet3_onnx.tar.gz'),
+          path.join(denoiseDir, 'deepfilternet/v2/models/DeepFilterNet3_onnx.tar.gz'),
+        ],
+      ];
+      const dfnMissing = dfnAssets.filter(([s]) => !fs.existsSync(s)).map(([s]) => s);
       if (dfnMissing.length > 0) {
         throw new Error(
-          `[lotus-denoise] DeepFilterNet 3 asset(s) missing — build aborted to avoid shipping a broken ML feature:\n  ${dfnMissing.join('\n  ')}\n(Run \`npm ci\`; the vendored wasm/model live under build/denoise-vendor/deepfilternet/.)`,
+          '[lotus-denoise] DeepFilterNet 3 asset(s) missing — build aborted to avoid ' +
+            'shipping a broken ML feature:\n  ' +
+            dfnMissing.join('\n  ') +
+            '\n(Run `npm ci`; the vendored wasm/model live under build/denoise-vendor/deepfilternet/.)',
         );
       }
-      dfn.forEach(([s, rel]) => {
-        const d = path.join(denoiseDir, rel);
+      dfnAssets.forEach(([s, d]) => {
         fs.mkdirSync(path.dirname(d), { recursive: true });
         fs.copyFileSync(s, d);
       });