LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

[QA] Invite QR is generated locally: no api.qrserver.com request, scans to the right matrix.to link, works offline #192

New Issue
Closed
opened 2026-09-17 23:24:11 -04:00 by jared · 1 comment
jared commented 2026-09-17 23:24:11 -04:00
Owner
Copy Link
Copy Source

Migrated from LOTUS_TESTING.md → Outstanding verification backlog on 2026-09-17.

Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors.

  • Verified live

Invite QR is now generated LOCALLY (2026-07): Room settings → Share Room → the QR code renders (a black-on-white SVG in a white box) with no network request to api.qrserver.com (check DevTools Network — there should be no external QR fetch, and it should work offline / behind strict CSP). Scan it with a phone camera / Matrix app → it opens the correct matrix.to room-invite link. (api.qrserver.com was removed from the prod CSP img-src, so a regression would make the QR blank rather than silently phone home.)

_Migrated from `LOTUS_TESTING.md` → Outstanding verification backlog on 2026-09-17._ Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors. - [ ] Verified live --- **Invite QR is now generated LOCALLY (2026-07):** Room settings → Share Room → the QR code renders (a black-on-white SVG in a white box) with **no network request** to `api.qrserver.com` (check DevTools Network — there should be no external QR fetch, and it should work offline / behind strict CSP). **Scan it** with a phone camera / Matrix app → it opens the correct `matrix.to` room-invite link. (`api.qrserver.com` was removed from the prod CSP img-src, so a regression would make the QR blank rather than silently phone home.)
jared added this to the Manual QA backlog milestone 2026-09-17 23:24:11 -04:00
jared added the securityarea: navigationqa labels 2026-09-17 23:24:11 -04:00
jared commented 2026-09-18 00:47:40 -04:00
Author
Owner
Copy Link
Copy Source

Tested on the local dev homeserver with Playwright, counting every request to a non-local host.

Found a gap: the July fix (a899d7d3) only converted Room Settings → General → Share (RoomShareInvite.tsx). The Invite dialog (header ⋮ → Invite, Room Intro "Invite Member", space menu → Invite) still had <img src="https://api.qrserver.com/…?data=<invite link>"> — leaking the room link to a third party, and on prod (where the CSP img-src no longer allows that host) showing a broken image when you press QR Code.

Fixed in the next commit on lotus: same QRCodeSVG + white quiet zone. After the fix:

surface QR remote <img> external requests
Invite dialog → QR Code SVG ✓, matrix.to link shown under it 0 0
Room Settings → Share SVG ✓ + Download QR 0 0

Scanning with a phone camera is the one step I can't do here; the SVG encodes inviteUrl verbatim (same call as the Room Settings QR you already scanned in July). Closing.

Tested on the local dev homeserver with Playwright, counting every request to a non-local host. **Found a gap:** the July fix (`a899d7d3`) only converted **Room Settings → General → Share** (`RoomShareInvite.tsx`). The **Invite dialog** (header ⋮ → Invite, Room Intro "Invite Member", space menu → Invite) still had `<img src="https://api.qrserver.com/…?data=<invite link>">` — leaking the room link to a third party, and on prod (where the CSP `img-src` no longer allows that host) showing a broken image when you press **QR Code**. Fixed in the next commit on `lotus`: same `QRCodeSVG` + white quiet zone. After the fix: | surface | QR | remote `<img>` | external requests | |---|---|---|---| | Invite dialog → QR Code | SVG ✓, matrix.to link shown under it | 0 | 0 | | Room Settings → Share | SVG ✓ + Download QR | 0 | 0 | Scanning with a phone camera is the one step I can't do here; the SVG encodes `inviteUrl` verbatim (same call as the Room Settings QR you already scanned in July). Closing.
jared closed this issue 2026-09-18 00:47:40 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: navigation qa security
Milestone
No items
No Milestone Manual QA backlog
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#192