SearchContextManager/Grid from @giphy/react-components talk to api.giphy.com straight
from the browser with the gifApiKey from config.json, so every keystroke-driven GIF search, plus the
user's IP and the Giphy API key, goes to a third party. The Recent row additionally loads previewUrls from Giphy's CDN directly (not proxied through the homeserver like every other preview
image) the instant the picker opens, even before the user types. None of this is covered by the urlPreview / mediaAutoLoad privacy settings, and there is no UI disclosure. (Note the picker is
currently inert in this deployment — gifApiKey is "" — so this bites whenever the key is filled in.)
How to trigger
set gifApiKey in config.json, open the GIF picker — network tab shows api.giphy.com and media*.giphy.com requests before any interaction.
Suggested fix
gate the picker behind an explicit opt-in (or the existing third-party-content setting)
with a one-line disclosure, and proxy the Recent thumbnails through the homeserver's media repo (the
sent GIF is already re-uploaded as mxc://, so a preview mxc is available).
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** security · **Confidence:** high
**Location:** `src/app/components/GifPicker.tsx:186-236`, `src/app/components/GifPicker.tsx:78-104` (recent thumbnails), `src/app/features/room/RoomInput.tsx:373,1184-1205`, `config.json:12`
### Problem
`SearchContextManager`/`Grid` from `@giphy/react-components` talk to `api.giphy.com` straight
from the browser with the `gifApiKey` from `config.json`, so every keystroke-driven GIF search, plus the
user's IP and the Giphy API key, goes to a third party. The Recent row additionally loads
`previewUrl`s from Giphy's CDN directly (not proxied through the homeserver like every other preview
image) the instant the picker opens, even before the user types. None of this is covered by the
`urlPreview` / `mediaAutoLoad` privacy settings, and there is no UI disclosure. (Note the picker is
currently inert in this deployment — `gifApiKey` is `""` — so this bites whenever the key is filled in.)
### How to trigger
set `gifApiKey` in `config.json`, open the GIF picker — network tab shows `api.giphy.com` and
`media*.giphy.com` requests before any interaction.
### Suggested fix
gate the picker behind an explicit opt-in (or the existing third-party-content setting)
with a one-line disclosure, and proxy the Recent thumbnails through the homeserver's media repo (the
sent GIF is already re-uploaded as `mxc://`, so a preview mxc is available).
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:24 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: security · Confidence: high
Location:
src/app/components/GifPicker.tsx:186-236,src/app/components/GifPicker.tsx:78-104(recent thumbnails),src/app/features/room/RoomInput.tsx:373,1184-1205,config.json:12Problem
SearchContextManager/Gridfrom@giphy/react-componentstalk toapi.giphy.comstraightfrom the browser with the
gifApiKeyfromconfig.json, so every keystroke-driven GIF search, plus theuser's IP and the Giphy API key, goes to a third party. The Recent row additionally loads
previewUrls from Giphy's CDN directly (not proxied through the homeserver like every other previewimage) the instant the picker opens, even before the user types. None of this is covered by the
urlPreview/mediaAutoLoadprivacy settings, and there is no UI disclosure. (Note the picker iscurrently inert in this deployment —
gifApiKeyis""— so this bites whenever the key is filled in.)How to trigger
set
gifApiKeyinconfig.json, open the GIF picker — network tab showsapi.giphy.comandmedia*.giphy.comrequests before any interaction.Suggested fix
gate the picker behind an explicit opt-in (or the existing third-party-content setting)
with a one-line disclosure, and proxy the Recent thumbnails through the homeserver's media repo (the
sent GIF is already re-uploaded as
mxc://, so a preview mxc is available).Filed from the September 2026 client audit (branch
lotus@4bea4895).