Allow the video frame scheme in the page's own CSP

asxpi commented

2026-10-17 07:52:48 +00:00

First-time contributor

The native engine's video reaches the page over the shell's tackyvideo
scheme (tackyvideo://localhost on Linux and macOS,
http://tackyvideo.localhost on Windows and Android). ee7d3ed put it in
tauri.conf.json's connect-src, but index.html's meta policy is enforced
alongside it and does not name the scheme, so every frame fetch was
refused:

Refused to connect to tackyvideo://localhost/... because it does not
appear in the connect-src directive of the Content Security Policy.

and a video call showed neither the peer nor the self-view, on the
desktop and in the Android app alike.

Name both forms in index.html's connect-src too. Tested in the AppImage
and on a Pixel 9: both pictures are drawn.

🤖 Generated with Claude Code

The native engine's video reaches the page over the shell's tackyvideo scheme (tackyvideo://localhost on Linux and macOS, http://tackyvideo.localhost on Windows and Android). ee7d3ed put it in tauri.conf.json's connect-src, but index.html's meta policy is enforced alongside it and does not name the scheme, so every frame fetch was refused: Refused to connect to tackyvideo://localhost/... because it does not appear in the connect-src directive of the Content Security Policy. and a video call showed neither the peer nor the self-view, on the desktop and in the Android app alike. Name both forms in index.html's connect-src too. Tested in the AppImage and on a Pixel 9: both pictures are drawn. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

asxpi added 1 commit

2026-10-17 07:52:48 +00:00

Allow the video frame scheme in the page's own CSP 8252a61817

The native engine's video reaches the page over the shell's tackyvideo
scheme (tackyvideo://localhost on Linux and macOS,
http://tackyvideo.localhost on Windows and Android). ee7d3ed put it in
tauri.conf.json's connect-src, but index.html's meta policy is enforced
alongside it and does not name the scheme, so every frame fetch was
refused:

  Refused to connect to tackyvideo://localhost/... because it does not
  appear in the connect-src directive of the Content Security Policy.

and a video call showed neither the peer nor the self-view, on the
desktop and in the Android app alike.

Name both forms in index.html's connect-src too. Tested in the AppImage
and on a Pixel 9: both pictures are drawn.

Assisted-by: Claude:opus-5-5

ann commented

2026-10-17 14:59:11 +00:00

Owner

Merged by hand into develop (now at aa2fbcbf, on libtacky v1.0.0-rc10) for the 0.6.0 testing builds; thank you. Closing, since a hand merge is not marked merged here.

Merged by hand into develop (now at aa2fbcbf, on libtacky v1.0.0-rc10) for the 0.6.0 testing builds; thank you. Closing, since a hand merge is not marked merged here.

ann closed this pull request

2026-10-17 14:59:12 +00:00

ann referenced this pull request from a commit

2026-10-17 14:59:13 +00:00

libtacky pinned at v1.0.0-rc10 (8411e18f): rc9 plus the room mute (chats mute on a room turns its mentions off), PR #8 (Android frame streams renamed where link() is denied, so a video call on the phone shows both pictures), PR #9 (session-terminate when the media path closes or fails), PR #10 (SRV looked up through Android's own resolver) and the OMEMO trust-list republishing loop between two verified devices; the changelog's Unreleased section names what this build gains from the merged app PRs #19, #20 and #21, the libtacky fixes, and the OMEMO mode re-read, and says that another device's OMEMO on/off choice is taken only once that device is verified by hand, which is libtacky's rule.

ann referenced this pull request from a commit

2026-10-27 13:09:52 +00:00

The remaining Lows of the final anotherim-js audit of 2026-10-27 (/data/another-im/audit-2026-10-27-final-anotherim-js.md): XEP-0439 actions are not drawn in rooms (#12: rowActions(m, room), message-row passes showNick, which both callers set from the chat's groupchat; libtacky refuses the press there and any occupant could draw buttons; whether action-selected goes out encrypted in an OMEMO chat is F2's libtacky half), a quick response chip shows the value it sends after its label whenever the two differ but for case and spacing (#13: XEP-0439 sends the value and only shows the label, so the new shownValue keeps the XEP and the reader sees the words before they go), isReportable is false for a room occupant's private chat since Blocking keeps bare JIDs and would block and report the whole room (#17, the safe one of the two choices), a vCard's tel: link carries data-ask and the link guard asks "Call {number}?" / "This opens {number} in your phone or calling app." before the opener in the shells and in a tab alike (#18), the desktop shell's openable hands a TEL: link on as tel: (#21, now a Cow), a gateway's auto-approved contact is added with no roster name instead of the subscribe nick (#19: their nick is their word, the name drawn then comes from their vCard or nick as theirs), and localHost, the page's sticker gate, also refuses a single-label host and names under .local, .localdomain, .home.arpa, .internal, .lan, .home, .intranet, .corp and .private, with the browser edition's remaining gap (a public-looking name resolving to a private address) documented at the function (#20). New strings in en, ru, uk, et and es; CHANGELOG Unreleased has a Security block naming the audit ids. Tests that failed before the fix (9 of them): quick-responses (rowActions in a room, shownValue, the chip showing "Large one Large"), report-spam (PM not reportable), requests (gateway contact added without a name), transfers (localHost local names), os-links (the tel question), links-cov (a data-ask tel opens through the question in a tab), vcard-profiles (tel link has data-ask); links.rs a_tel_scheme_in_upper_case_is_handed_on_in_lower_case. make -o audit check STRICT=1 clean (2110 keys), make test-ui 384 files 4246 passed 8 skipped, make test-shell ok, WebKit smoke 6769 ok with the contact info and profile card screens, its 4 FAILs the stale Android lock-line checks b1bdb10a fixed on develop.

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

Allow the video frame scheme in the page's own CSP #19

Pull request closed