search

Johni0702 / mumble-web

An HTML5 Mumble client
682 stars 151 forks source link

Improvements in chat #129

Closed joker-x closed 3 years ago

joker-x commented 4 years ago

image

image

Johni0702 commented 3 years ago

I've cherry-picked some of your commits from this PR into master. Notable exceptions being anything related to youtube and image embeds because of two concerns:

  1. Image preview is a privacy concern as it allows any user which can send messages to direct any other users browser to load any arbitrary image. Thereby among other things leaking their IP without user interaction.
  2. The implementation allows for anyone who can send messages to inject and execute arbitrary JavaScript in other user's browser. You can easily test this yourself by just sending either of these messages: youtube.com/watch?v=invalid"onload="alert(1)// https://i.johni0702.de/Rrisv.png"onload="alert(1)//.png Sending them to yourself will immediately trigger the issue. To send them to someone else, you must ensure that they're not filtered on the sending side (with the native mumble client: right-click user/channel -> Send Message -> Switch to Source Text tab).
joker-x commented 3 years ago

Thank you very much for your comments. Right now I will reverse them in my instances. I can't believe I made these dangerous newbie mistakes, sorry.

Embedding youtube videos I can easily fix if you are interested in incorporating that functionality, but embedding images can't figure out how to do it.