From 37c9348ee869776eef1a81d0ebb8a45b2d62e05e Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sat, 12 Sep 2026 11:34:08 -0400 Subject: [PATCH] fix(lotus): enable strictOriginCheck on the widget transport matrix-widget-api's PostmessageTransport accepts toWidget actions from any origin by default; the fork added actions that inject audio, deafen, retune the encoder and render images. EC is served same-origin with the cinny host, so globalThis.origin === parentOrigin and the strict check passes. Fixes #15 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA --- src/widget.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/widget.ts b/src/widget.ts index 4c4e9d1d..2511376a 100644 --- a/src/widget.ts +++ b/src/widget.ts @@ -93,6 +93,16 @@ export const initializeWidget = ( const parentOrigin = new URL(parentUrl).origin; logger.info("Widget API is available"); const api = new WidgetApi(widgetId, parentOrigin); + // [lotus] matrix-widget-api's PostmessageTransport defaults + // strictOriginCheck to false, which would let any frame holding a + // handle to our window post toWidget actions (including the + // io.lotus.* actions below). The Lotus deployment serves EC + // same-origin with the host (cinny loads /public/element-call/index.html), + // so globalThis.origin === parentOrigin and this check passes safely. + // A cross-origin deployment would need to compare ev.origin to + // parentOrigin instead, since strictOriginCheck compares against + // globalThis.origin. + api.transport.strictOriginCheck = true; api.requestCapability(MatrixCapabilities.AlwaysOnScreen); api.requestCapability(MatrixCapabilities.MSC4039DownloadFile);