[QA] Invite QR is generated locally: no api.qrserver.com request, scans to the right matrix.to link, works offline #192

New Issue

2026-09-17T23:24:11-04:00

jared commented

2026-09-17 23:24:11 -04:00

Migrated from LOTUS_TESTING.md → Outstanding verification backlog on 2026-09-17.

Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors.

Verified live

Invite QR is now generated LOCALLY (2026-07): Room settings → Share Room → the QR code renders (a black-on-white SVG in a white box) with no network request to api.qrserver.com (check DevTools Network — there should be no external QR fetch, and it should work offline / behind strict CSP). Scan it with a phone camera / Matrix app → it opens the correct matrix.to room-invite link. (api.qrserver.com was removed from the prod CSP img-src, so a regression would make the QR blank rather than silently phone home.)

_Migrated from `LOTUS_TESTING.md` → Outstanding verification backlog on 2026-09-17._ Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors. - [ ] Verified live --- **Invite QR is now generated LOCALLY (2026-07):** Room settings → Share Room → the QR code renders (a black-on-white SVG in a white box) with **no network request** to `api.qrserver.com` (check DevTools Network — there should be no external QR fetch, and it should work offline / behind strict CSP). **Scan it** with a phone camera / Matrix app → it opens the correct `matrix.to` room-invite link. (`api.qrserver.com` was removed from the prod CSP img-src, so a regression would make the QR blank rather than silently phone home.)

jared added this to the Manual QA backlog milestone 2026-09-17 23:24:11 -04:00

jared added the security area: navigation qa labels 2026-09-17 23:24:11 -04:00

jared commented

2026-09-18 00:47:40 -04:00

Tested on the local dev homeserver with Playwright, counting every request to a non-local host.

Found a gap: the July fix (a899d7d3) only converted Room Settings → General → Share (RoomShareInvite.tsx). The Invite dialog (header ⋮ → Invite, Room Intro "Invite Member", space menu → Invite) still had <img src="https://api.qrserver.com/…?data=<invite link>"> — leaking the room link to a third party, and on prod (where the CSP img-src no longer allows that host) showing a broken image when you press QR Code.

Fixed in the next commit on lotus: same QRCodeSVG + white quiet zone. After the fix:

surface	QR	remote `<img>`	external requests
Invite dialog → QR Code	SVG ✓, matrix.to link shown under it	0	0
Room Settings → Share	SVG ✓ + Download QR	0	0

Scanning with a phone camera is the one step I can't do here; the SVG encodes inviteUrl verbatim (same call as the Room Settings QR you already scanned in July). Closing.

Tested on the local dev homeserver with Playwright, counting every request to a non-local host. **Found a gap:** the July fix (`a899d7d3`) only converted **Room Settings → General → Share** (`RoomShareInvite.tsx`). The **Invite dialog** (header ⋮ → Invite, Room Intro "Invite Member", space menu → Invite) still had `<img src="https://api.qrserver.com/…?data=<invite link>">` — leaking the room link to a third party, and on prod (where the CSP `img-src` no longer allows that host) showing a broken image when you press **QR Code**. Fixed in the next commit on `lotus`: same `QRCodeSVG` + white quiet zone. After the fix: | surface | QR | remote `<img>` | external requests | |---|---|---|---| | Invite dialog → QR Code | SVG ✓, matrix.to link shown under it | 0 | 0 | | Room Settings → Share | SVG ✓ + Download QR | 0 | 0 | Scanning with a phone camera is the one step I can't do here; the SVG encodes `inviteUrl` verbatim (same call as the Room Settings QR you already scanned in July). Closing.

jared closed this issue

2026-09-18 00:47:40 -04:00

jared referenced this issue from a commit

2026-09-18 18:01:17 -04:00

fix(invite): the header Invite dialog's QR was still fetched from api.qrserver.com — render it locally (#192)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#192