LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Call hotkeys: rebind has no denylist, modifiers ignored, Space swallowed on buttons, duplicate bindings allowed #23

New Issue
Closed
opened 2026-09-12 01:50:56 -04:00 by jared · 0 comments
jared commented 2026-09-12 01:50:56 -04:00
Owner
Copy Link
Copy Source

Severity: high · Type: a11y · Confidence: high

Location: src/app/features/settings/general/General.tsx:1477-1500 (useKeyBind — only excludes Escape); runtime consumer src/app/features/call/CallControls.tsx:172-188 (onKeyDown calls e.preventDefault() unconditionally whenever e.code === pttKey and the focus target isn't editable)
src/app/features/call/CallControls.tsx:172-195,256-262, src/app/features/settings/general/General.tsx:1477-1500

Problem

useKeyBind captures literally any KeyboardEvent.code from Settings → General → Calls and stores it verbatim as pttKey/deafenKey, denylisting only Escape. The runtime PTT listener in CallControls.tsx then calls preventDefault() on every matching keydown outside an editable field. If a keyboard-only user (deliberately, or by mis-click while trying to rebind) sets the PTT or deafen key to Tab, ArrowUp/Down/Left/Right, Space outside a field, or Enter, that key stops moving focus / activating controls anywhere in the app for the duration of the call — a full keyboard trap that can only be escaped by ending the call or reloading. There is also no check that pttKey !== deafenKey, so a user can silently bind both actions to the same key.

Second mechanism (related finding): both key handlers match on e.code only — no check of ctrlKey / metaKey / altKey / shiftKey. With the default deafenKey: 'KeyM', Ctrl+M, Alt+M and macOS Cmd+M (minimise window) all toggle deafen and get preventDefault()ed. With the default pttKey: 'Space', PTT preventDefault()s every Space press outside an input — which is how keyboard users activate <button>s, so during a call in PTT mode Space no longer activates the mic/deafen/hangup buttons or scrolls the page. useKeyBind also accepts any key without validation or conflict detection, so PTT and deafen can be bound to the same key.

How to trigger

Settings → General → Calls → click the Push-to-talk key field → press Tab. Join/start a call; pressing Tab anywhere non-editable in the app now toggles the mic and is swallowed instead of moving focus.

Also: join a call with PTT on, Tab to the End button, press Space — nothing happens. Or press Cmd+M / Ctrl+M during any call.

Suggested fix

Denylist Tab, ShiftLeft/Right (already a modifier concern), arrow keys, and other navigation-critical codes in useKeyBind, and warn/reject when the new binding equals the other call-shortcut key.

Also: ignore events with any modifier held in both handlers; only preventDefault() the PTT key when the event target is not an interactive control; reject duplicate/reserved bindings in useKeyBind.

Filed from the September 2026 client audit (branch lotus @ 4bea4895).

**Severity:** high · **Type:** a11y · **Confidence:** high **Location:** `src/app/features/settings/general/General.tsx:1477-1500` (`useKeyBind` — only excludes `Escape`); runtime consumer `src/app/features/call/CallControls.tsx:172-188` (`onKeyDown` calls `e.preventDefault()` unconditionally whenever `e.code === pttKey` and the focus target isn't editable) `src/app/features/call/CallControls.tsx:172-195,256-262`, `src/app/features/settings/general/General.tsx:1477-1500` ### Problem `useKeyBind` captures literally any `KeyboardEvent.code` from Settings → General → Calls and stores it verbatim as `pttKey`/`deafenKey`, denylisting only `Escape`. The runtime PTT listener in `CallControls.tsx` then calls `preventDefault()` on every matching keydown outside an editable field. If a keyboard-only user (deliberately, or by mis-click while trying to rebind) sets the PTT or deafen key to `Tab`, `ArrowUp/Down/Left/Right`, `Space` outside a field, or `Enter`, that key stops moving focus / activating controls anywhere in the app for the duration of the call — a full keyboard trap that can only be escaped by ending the call or reloading. There is also no check that `pttKey !== deafenKey`, so a user can silently bind both actions to the same key. **Second mechanism (related finding):** both key handlers match on `e.code` only — no check of `ctrlKey` / `metaKey` / `altKey` / `shiftKey`. With the default `deafenKey: 'KeyM'`, `Ctrl+M`, `Alt+M` and macOS `Cmd+M` (minimise window) all toggle deafen *and* get `preventDefault()`ed. With the default `pttKey: 'Space'`, PTT `preventDefault()`s every Space press outside an input — which is how keyboard users activate `<button>`s, so during a call in PTT mode Space no longer activates the mic/deafen/hangup buttons or scrolls the page. `useKeyBind` also accepts any key without validation or conflict detection, so PTT and deafen can be bound to the same key. ### How to trigger Settings → General → Calls → click the Push-to-talk key field → press `Tab`. Join/start a call; pressing Tab anywhere non-editable in the app now toggles the mic and is swallowed instead of moving focus. Also: join a call with PTT on, Tab to the End button, press Space — nothing happens. Or press Cmd+M / Ctrl+M during any call. ### Suggested fix Denylist `Tab`, `ShiftLeft/Right` (already a modifier concern), arrow keys, and other navigation-critical codes in `useKeyBind`, and warn/reject when the new binding equals the other call-shortcut key. Also: ignore events with any modifier held in both handlers; only `preventDefault()` the PTT key when the event target is not an interactive control; reject duplicate/reserved bindings in `useKeyBind`. --- _Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:56 -04:00
jared added the priority: higha11yarea: calls labels 2026-09-12 01:50:56 -04:00
jared self-assigned this 2026-09-12 01:50:56 -04:00
jared closed this issue 2026-09-12 14:59:48 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels a11y area: calls priority: high
Milestone
No items
No Milestone Audit 2026-09 · High
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees jared
1 Participants
Notifications
Due Date
2026-10-14
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#23