fix(security): widget consents and shared files cleared on logout; forged shares refused (#266, #267)

Conversation 0 Commits 1 Files Changed 10

+128 -4

1 Commits

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	14f05a3d5c	fix(security): widget consents and shared files cleared on logout; forged shares refused (#266 , #267 ) CI / Build & Quality Checks (pull_request) Successful in 1m53s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 7s Details CI / Playwright smoke (e2e) (pull_request) Successful in 12m51s Details #266: remembered widget approvals (lotus.widgetConsent.*) survived logout, so they applied silently to the next account on the device and listed the previous account's rooms; clearPlaintextCaches now sweeps them. Space structure, call membership and Lotus room-policy state join PROTECTED_STATE_TYPES, so no widget can be granted them. #267: any website could auto-submit a form to /share-target and land the user in the share picker with attacker-chosen text and files. The worker now refuses a share whose Origin is another site. (Sec-Fetch-Site, as the issue suggested, never reaches a service worker: checked in Chromium.) Origin null/absent, as the OS share sheet sends, stays accepted, and /share now says the content came from another app or website. Both logout paths await clearSharedPayload(); the server-forced one also clears the soundboard clip cache, as #57 intended. Fixes #266 Fixes #267 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 14:47:11 -04:00

Author

SHA1

Message

Date

Lotus CIandClaude Opus 5.5

14f05a3d5c

fix(security): widget consents and shared files cleared on logout; forged shares refused (#266 , #267 )

CI / Build & Quality Checks (pull_request) Successful in 1m53s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Successful in 7s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 12m51s

Details

#266: remembered widget approvals (lotus.widgetConsent.*) survived logout,
so they applied silently to the next account on the device and listed the
previous account's rooms; clearPlaintextCaches now sweeps them. Space
structure, call membership and Lotus room-policy state join
PROTECTED_STATE_TYPES, so no widget can be granted them.

#267: any website could auto-submit a form to /share-target and land the
user in the share picker with attacker-chosen text and files. The worker
now refuses a share whose Origin is another site. (Sec-Fetch-Site, as the
issue suggested, never reaches a service worker: checked in Chromium.)
Origin null/absent, as the OS share sheet sends, stays accepted, and
/share now says the content came from another app or website. Both logout
paths await clearSharedPayload(); the server-forced one also clears the
soundboard clip cache, as #57 intended.

Fixes #266
Fixes #267

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

2026-10-19 14:47:11 -04:00

fix(security): widget consents and shared files cleared on logout; forged shares refused (#266, #267) #429