#16148

Earn the notification Join button by the link's host

Openmrjamesmyerswants to merge intofrom

Problem

Detect.scan marks a card's first link as a meeting with an unanchored test on the whole URL (shell/plugins/notifications/Detect.js:92,130):

var MEETING = /(zoom\.us|meet\.google\.com|teams\.microsoft\.com|teams\.live\.com|whereby\.com|meet\.jit\.si)/i
meeting: link.length ? MEETING.test(link[0]) : false,

So https://zoom.us.example.com/j/1, https://example.com/meet.google.com and https://example.com/?r=teams.microsoft.com all get the "Join" label and the video glyph (Toast.qml:118-133) instead of "Open link". Any sender can do this, including a website through browser notifications, because Detect scans the body text of the notification.

Change

Match the host from Security.hostOf() against (?:^|\.)(zoom\.us|meet\.google\.com|…)$. Subdomains such as us02web.zoom.us still match. This PR also adds regression cases to test/shell.d/notifications/logic.cjs. The new test fails on v4.5.0-rc1 and passes with the change.

Found while testing Omarchy 4.5.0-rc1.

Activity

2
greptile-apps[bot]11h ago

Confidence Score: 5/5

[Low impact] The PR appears safe to merge.

Summary

Restricts the notification Join button to recognized meeting hosts and their subdomains.

  • Notification links earn Join only from a meeting-service host.

Reviews (1) · Last reviewed commit: "Earn the notification Join button by the..." · Reviewed by Greptile