Problem
Detect.scan marks a card's first link as a meeting with an unanchored test on the whole URL (shell/plugins/notifications/Detect.js:92,130):
var MEETING = /(zoom\.us|meet\.google\.com|teams\.microsoft\.com|teams\.live\.com|whereby\.com|meet\.jit\.si)/i
meeting: link.length ? MEETING.test(link[0]) : false,So https://zoom.us.example.com/j/1, https://example.com/meet.google.com and https://example.com/?r=teams.microsoft.com all get the "Join" label and the video glyph (Toast.qml:118-133) instead of "Open link". Any sender can do this, including a website through browser notifications, because Detect scans the body text of the notification.
Change
Match the host from Security.hostOf() against (?:^|\.)(zoom\.us|meet\.google\.com|…)$. Subdomains such as us02web.zoom.us still match. This PR also adds regression cases to test/shell.d/notifications/logic.cjs. The new test fails on v4.5.0-rc1 and passes with the change.
Found while testing Omarchy 4.5.0-rc1.
[Low impact] The PR appears safe to merge.
Summary
Restricts the notification Join button to recognized meeting hosts and their subdomains.
Reviews (1) · Last reviewed commit: "Earn the notification Join button by the..." · Reviewed by Greptile