jaredandClaude Opus 5 74d8e3119b feat(security): confirm before opening a link whose text names a different site (#122) ...

utils/linkSafety.ts compares the registrable domain the visible text claims
(when it looks like a URL/host) with the href's; a mismatch, or a punycode
(IDN) destination, renders the anchor as SuspiciousLink, whose click opens a
confirm — "It shows matrix.lotusguild.org but goes to evil.example." with the
full URL, Cancel / Open anyway (opens in a new tab with noopener). Honest links
are untouched: same registrable domain (youtube.com text over www.youtube.com,
bbc.co.uk over news.bbc.co.uk), plain-word text, mailto:, matrix.to and Lotus
permalinks, anchors with non-text children. Comparator unit-tested (incl. a
Cyrillic-а paypal homograph); verified headless that the phish and IDN
messages are flagged, the honest ones are not, the click shows the confirm and
does not navigate, Cancel keeps you put, Open anyway opens the real target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

2026-09-19 22:57:07 -04:00

..

translation

fix(translation): address review findings

2026-07-18 16:18:27 -04:00

a11y.test.ts

feat(a11y): message semantics for screen readers (P3-4)

2026-07-02 11:45:21 -04:00

a11y.ts

feat(a11y): message semantics for screen readers (P3-4)

2026-07-02 11:45:21 -04:00

accentColor.test.ts

feat(accent): custom accent themes links, text selection, and focus rings

2026-07-01 16:44:26 -04:00

accentColor.ts

feat(accent): custom accent themes links, text selection, and focus rings

2026-07-01 16:44:26 -04:00

accountData.ts

DP16: add typed get/setAccountData helpers, remove ~19 any-casts

2026-07-07 23:14:35 -04:00

ASCIILexicalTable.test.ts

fix(utils): findAndReplace infinite loop on non-global regex + tests (+28)

2026-06-30 11:15:39 -04:00

ASCIILexicalTable.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

AsyncSearch.test.ts

fix(utils): findAndReplace infinite loop on non-global regex + tests (+28)

2026-06-30 11:15:39 -04:00

AsyncSearch.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

blurHash.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

bookmarks.test.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

bookmarks.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

callKeybind.test.ts

fix(calls): hotkey rebind denylist; ignore modifiers; keep Space on buttons

2026-09-12 14:48:34 -04:00

callKeybind.ts

fix(calls): hotkey rebind denylist; ignore modifiers; keep Space on buttons

2026-09-12 14:48:34 -04:00

callQuality.test.ts

feat(call): in-call soundboard, quality controls, room call-permissions

2026-06-30 22:34:17 -04:00

callQuality.ts

docs: move the LOTUS_TODO / LOTUS_TESTING backlogs into Gitea issues; keep a reference-only LOTUS_REFERENCE.md

2026-09-17 23:26:21 -04:00

callSoundDebounce.test.ts

feat(calls): debounce join/leave cues for a flapping participant (#145)

2026-09-19 00:15:34 -04:00

callSoundDebounce.ts

feat(calls): debounce join/leave cues for a flapping participant (#145)

2026-09-19 00:15:34 -04:00

callSounds.test.ts

test(callSounds): cover join/leave sound design + AudioContext lifecycle

2026-06-30 18:49:02 -04:00

callSounds.ts

fix: make call join/leave sounds audible to all participants + server-side hard voice limit docs

2026-06-12 23:45:31 -04:00

caseCollision.test.ts

fix(build): rename threadSummary.ts — case-collision broke the Windows release

2026-07-01 23:43:20 -04:00

clockSkew.test.ts

feat: warn when the local clock is far off the homeserver's (#158)

2026-09-19 12:52:03 -04:00

clockSkew.ts

feat: warn when the local clock is far off the homeserver's (#158)

2026-09-19 12:52:03 -04:00

common.test.ts

test: add unit-test harness (tsx + node:test) + first suite for utils/common

2026-06-30 08:45:22 -04:00

common.ts

test: add unit-test harness (tsx + node:test) + first suite for utils/common

2026-06-30 08:45:22 -04:00

cryptoDiagLog.test.ts

test: cover cryptoDiagLog + closedLobbyCategories

2026-07-19 22:38:02 -04:00

cryptoDiagLog.ts

docs: move the LOTUS_TODO / LOTUS_TESTING backlogs into Gitea issues; keep a reference-only LOTUS_REFERENCE.md

2026-09-17 23:26:21 -04:00

datetimeInput.test.ts

feat(reminders): view and cancel a message's existing reminders

2026-07-10 15:51:11 -04:00

datetimeInput.ts

feat(reminders): view and cancel a message's existing reminders

2026-07-10 15:51:11 -04:00

deafenCatchUp.test.ts

feat(calls): undeafen catch-up toast (#128)

2026-09-19 17:17:58 -04:00

deafenCatchUp.ts

feat(calls): undeafen catch-up toast (#128)

2026-09-19 17:17:58 -04:00

decryptionReason.test.ts

feat(e2ee): undecryptable placeholder says why and offers the fix (#159)

2026-09-19 13:23:25 -04:00

decryptionReason.ts

feat(e2ee): undecryptable placeholder says why and offers the fix (#159)

2026-09-19 13:23:25 -04:00

denoisePipeline.ts

feat(denoise): add self-hosted DeepFilterNet 3 ML noise-suppression model

2026-06-17 19:57:08 -04:00

detachedTimeline.test.ts

fix(gallery): paginate media, activity log and export on detached timeline sets — never the live timeline (#163)

2026-09-18 00:03:54 -04:00

detachedTimeline.ts

fix(gallery): paginate media, activity log and export on detached timeline sets — never the live timeline (#163)

2026-09-18 00:03:54 -04:00

disposable.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

dom.test.ts

test: cover dom + emoji pure helpers; fix syntaxErrorPosition regex

2026-07-19 16:49:51 -04:00

dom.ts

feat(notifications): inline reply from a browser notification (#203)

2026-09-19 14:12:23 -04:00

draft.test.ts

feat(nav): draft indicator on room-nav items

2026-07-10 11:37:21 -04:00

draft.ts

fix(nav): harden draft indicator after review

2026-07-10 11:48:35 -04:00

featureCheck.test.ts

test: lotus decorations, call caps, crypto, featureCheck, typing, markdown (+34)

2026-06-30 14:32:53 -04:00

featureCheck.ts

feat: check IndexedDB support (#1630)

2024-01-23 18:36:55 +05:30

fileEntries.test.ts

feat(desktop): Tier B web side — toast actions, Focus Assist gate, folder DnD

2026-07-01 10:01:10 -04:00

fileEntries.ts

fix(desktop): address code-review findings on the desktop wave

2026-07-01 10:40:31 -04:00

findAndReplace.test.ts

fix(utils): findAndReplace infinite loop on non-global regex + tests (+28)

2026-06-30 11:15:39 -04:00

findAndReplace.ts

fix(utils): findAndReplace infinite loop on non-global regex + tests (+28)

2026-06-30 11:15:39 -04:00

imageCompression.test.ts

fix(ui): isMacOS always returned false on Macs + plugin-logic tests (+49)

2026-06-30 14:58:06 -04:00

imageCompression.ts

fix(wave-2): audit fixes — account-data races, search-cache wipe, export, media

2026-07-02 20:56:27 -04:00

key-symbol.ts

Add ESC btn to toolbar to quickly exit formatting (#1283)

2023-06-16 11:09:09 +10:00

keyboard.test.ts

test: add suite for utils/keyboard handlers (+4)

2026-06-30 13:50:55 -04:00

keyboard.ts

redesigned app settings and switch to rust crypto (#1988)

2025-02-10 16:49:47 +11:00

linkSafety.test.ts

feat(security): confirm before opening a link whose text names a different site (#122)

2026-09-19 22:57:07 -04:00

linkSafety.ts

feat(security): confirm before opening a link whose text names a different site (#122)

2026-09-19 22:57:07 -04:00

lotusDenoiseUtils.test.ts

feat(denoise): browser-native default, quality-ordered model picker, wire native-NS

2026-06-30 23:02:41 -04:00

lotusDenoiseUtils.ts

feat(denoise): browser-native default, quality-ordered model picker, wire native-NS

2026-06-30 23:02:41 -04:00

mathParse.test.ts

feat(messages): KaTeX math rendering (P4-4)

2026-07-01 21:19:02 -04:00

mathParse.ts

feat(messages): KaTeX math rendering (P4-4)

2026-07-01 21:19:02 -04:00

matrix-crypto.test.ts

test: lotus decorations, call caps, crypto, featureCheck, typing, markdown (+34)

2026-06-30 14:32:53 -04:00

matrix-crypto.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

matrix-uia.test.ts

test: add suites for accentColor (color math) + matrix-uia (auth flows) (+15)

2026-06-30 13:23:36 -04:00

matrix-uia.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

matrix.declineInvite.test.ts

fix(invites): decline invites robustly (no 500, no ghost, friendly error)

2026-07-05 11:55:35 -04:00

matrix.test.ts

test: add suites for time, matrix, mimeTypes, and search filters (+47 tests)

2026-06-30 10:27:57 -04:00

matrix.ts

fix(upload): plain-language upload failure text instead of the raw MatrixError (#213)

2026-09-19 12:31:26 -04:00

mimeTypes.test.ts

test: add suites for time, matrix, mimeTypes, and search filters (+47 tests)

2026-06-30 10:27:57 -04:00

mimeTypes.ts

fix: support audio with ogg filetype (#2924)

2026-05-14 15:16:54 +05:30

notifications.test.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

notifications.ts

fix(unread): stop stuck/resurrecting read indicators

2026-07-03 22:07:21 -04:00

notificationSounds.ts

feat: P2-3 sort rooms, P2-5 quiet hours, P2-2 custom notification sounds

2026-06-03 19:41:02 -04:00

poll.test.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

poll.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

presenceWrite.test.ts

fix(status): status save no longer fails on Synapse's 1-per-10s presence limit

2026-09-19 17:41:09 -04:00

presenceWrite.ts

fix(status): status save no longer fails on Synapse's 1-per-10s presence limit

2026-09-19 17:41:09 -04:00

pttHoldWatchdog.test.ts

fix(calls): release a push-to-talk hold after 5 minutes (#136)

2026-09-19 17:13:14 -04:00

pttHoldWatchdog.ts

fix(calls): release a push-to-talk hold after 5 minutes (#136)

2026-09-19 17:13:14 -04:00

pwaInstall.test.ts

feat(pwa): offer to install — Chromium prompt, iOS "Add to Home Screen" hint (#116)

2026-09-17 13:31:29 -04:00

pwaInstall.ts

feat(pwa): offer to install — Chromium prompt, iOS "Add to Home Screen" hint (#116)

2026-09-17 13:31:29 -04:00

redactOwnMessages.test.ts

feat(privacy): delete all my messages in a room (#169)

2026-09-19 14:33:33 -04:00

redactOwnMessages.ts

feat(privacy): delete all my messages in a room (#169)

2026-09-19 14:33:33 -04:00

regex.test.ts

test: add suite for utils/regex (sanitizeForRegex, URL/EMAIL/JUMBO_EMOJI)

2026-06-30 08:49:54 -04:00

regex.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

retention.test.ts

feat(rooms): Disappearing Messages (MSC1763 m.room.retention)

2026-07-03 11:23:14 -04:00

retention.ts

feat(rooms): Disappearing Messages (MSC1763 m.room.retention)

2026-07-03 11:23:14 -04:00

ringtones.ts

fix: low-tail correctness — thread notifs, call audio, OIDC expiry

2026-07-19 02:47:27 -04:00

room.test.ts

perf(notifications): memoize getNotificationType per push-rules object and room

2026-09-12 20:28:41 -04:00

room.ts

perf(notifications): memoize getNotificationType per push-rules object and room

2026-09-12 20:28:41 -04:00

rtc.ts

chore: upgrade i18next 26, prettier 3, fontsource-variable, domhandler 6, lint-staged 17

2026-05-21 23:30:50 -04:00

sanitize.test.ts

test: add XSS-prevention suite for utils/sanitize

2026-06-30 09:29:08 -04:00

sanitize.ts

fix(security,notifications): pre class allowlist, notification privacy + icon, sync-script safety (N100/N106/N109/N119)

2026-06-28 12:35:33 -04:00

scheduledMessages.encryption.test.ts

fix(composer): stop three E2EE plaintext leaks (compress, schedule, GIF)

2026-09-12 02:08:03 -04:00

scheduledMessages.test.ts

test(utils): cover scheduledMessages + lotusDenoiseUtils; fix AudioWorklet detect

2026-06-30 19:01:25 -04:00

scheduledMessages.ts

fix(composer): stop three E2EE plaintext leaks (compress, schedule, GIF)

2026-09-12 02:08:03 -04:00

searchCache.test.ts

fix(security): logout's search-index wipe coordinates across tabs

2026-09-15 21:32:06 -04:00

searchCache.ts

fix(security): logout's search-index wipe coordinates across tabs

2026-09-15 21:32:06 -04:00

searchCacheInvalidation.ts

fix(security): persistent search index forgets redacted and left-room text

2026-09-12 19:46:05 -04:00

serverAcl.test.ts

fix(security): tab-nabbing hardening + /acl self-lockout guard (SEC-3/4)

2026-07-18 21:23:35 -04:00

serverAcl.ts

fix(security): tab-nabbing hardening + /acl self-lockout guard (SEC-3/4)

2026-07-18 21:23:35 -04:00

settingsSync.test.ts

feat(settings): sync preferences across devices via io.lotus.settings account data (#104)

2026-09-17 01:56:06 -04:00

settingsSync.ts

feat(calls): system-wide PTT/deafen on desktop via the native key poll (cinny-desktop #2)

2026-09-17 13:39:51 -04:00

snooze.test.ts

feat(notifications): cross-platform "Pause Notifications" / snooze

2026-07-10 19:08:02 -04:00

snooze.ts

feat(notifications): cross-platform "Pause Notifications" / snooze

2026-07-10 19:08:02 -04:00

sort.test.ts

fix(ux): cap the in-app toast stack; stable "Unread First" room sort

2026-07-24 17:22:23 -04:00

sort.ts

fix(ux): cap the in-app toast stack; stable "Unread First" room sort

2026-07-24 17:22:23 -04:00

soundboardClips.test.ts

fix(security): revoke soundboard blob URLs on logout; cap the cache

2026-09-12 20:28:41 -04:00

soundboardClips.ts

fix(security): revoke soundboard blob URLs on logout; cap the cache

2026-09-12 20:28:41 -04:00

speakerSet.test.ts

perf(calls): speaker set only updates when it changes; DOM fallback detaches once the fork streams

2026-09-15 22:43:31 -04:00

speakerSet.ts

perf(calls): speaker set only updates when it changes; DOM fallback detaches once the fork streams

2026-09-15 22:43:31 -04:00

statusPresets.test.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

statusPresets.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

syntaxHighlight.test.ts

fix(ui): isMacOS always returned false on Macs + plugin-logic tests (+49)

2026-06-30 14:58:06 -04:00

syntaxHighlight.ts

fix(ui): forward-dialog header, notification presets, syntax-highlight tokens

2026-06-19 18:22:25 -04:00

textDiff.test.ts

fix(edit-history): harden diff after review

2026-07-10 11:11:16 -04:00

textDiff.ts

fix(edit-history): harden diff after review

2026-07-10 11:11:16 -04:00

threadList.test.ts

style: apply prettier across fork files

2026-07-11 13:52:36 -04:00

threadList.ts

feat(threads): room-level Threads list panel

2026-07-10 01:08:34 -04:00

threadNotifications.test.ts

fix: low-tail correctness — thread notifs, call audio, OIDC expiry

2026-07-19 02:47:27 -04:00

threadNotifications.ts

fix: low-tail correctness — thread notifs, call audio, OIDC expiry

2026-07-19 02:47:27 -04:00

time.test.ts

test: add suites for time, matrix, mimeTypes, and search filters (+47 tests)

2026-06-30 10:27:57 -04:00

time.ts

Add settings to enable 24-hour time format and customizable date format (#2347)

2025-07-27 22:13:00 +10:00

timeWindow.test.ts

feat(night-light): optional auto-on schedule (time window)

2026-07-10 16:05:56 -04:00

timeWindow.ts

feat(night-light): optional auto-on schedule (time window)

2026-07-10 16:05:56 -04:00

uploadError.test.ts

fix(upload): plain-language upload failure text instead of the raw MatrixError (#213)

2026-09-19 12:31:26 -04:00

uploadError.ts

fix(upload): plain-language upload failure text instead of the raw MatrixError (#213)

2026-09-19 12:31:26 -04:00

uploadRetry.test.ts

fix(upload): retry on dropped connections — the SDK reports XHR network failures as AbortError, which we treated as a user cancel (#172)

2026-09-18 17:58:15 -04:00

urlTracking.test.ts

feat(privacy): strip tracking parameters from links on paste, send and render (#103)

2026-09-17 01:46:21 -04:00

urlTracking.ts

feat(privacy): strip tracking parameters from links on paste, send and render (#103)

2026-09-17 01:46:21 -04:00

user-agent.test.ts

fix(ui): isMacOS always returned false on Macs + plugin-logic tests (+49)

2026-06-30 14:58:06 -04:00

user-agent.ts

fix(ui): isMacOS always returned false on Macs + plugin-logic tests (+49)

2026-06-30 14:58:06 -04:00

videoEmbed.test.ts

fix(embeds): animate GIF previews; add Mixcloud/Deezer; misc embed fixes

2026-07-24 00:21:10 -04:00

videoEmbed.ts

fix(embeds): animate GIF previews; add Mixcloud/Deezer; misc embed fixes

2026-07-24 00:21:10 -04:00