mirror of
https://github.com/vector-im/element-web.git
synced 2024-11-26 10:28:46 +08:00
c05c429803
Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com> Co-authored-by: github-merge-queue <github-merge-queue@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Florian Duros <florian.duros@ormaz.fr> Co-authored-by: Kim Brose <kim.brose@nordeck.net> Co-authored-by: Florian Duros <florianduros@element.io> Co-authored-by: R Midhun Suresh <hi@midhun.dev> Co-authored-by: dbkr <986903+dbkr@users.noreply.github.com> Co-authored-by: ElementRobot <releases@riot.im> Co-authored-by: dbkr <dbkr@users.noreply.github.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Michael Telatynski <7t3chguy@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: David Langley <davidl@element.io> Co-authored-by: Michael Weimann <michaelw@matrix.org> Co-authored-by: Timshel <Timshel@users.noreply.github.com> Co-authored-by: Sahil Silare <32628578+sahil9001@users.noreply.github.com> Co-authored-by: Will Hunt <will@half-shot.uk> Co-authored-by: Hubert Chathi <hubert@uhoreg.ca> Co-authored-by: Andrew Ferrazzutti <andrewf@element.io> Co-authored-by: Robin <robin@robin.town> Co-authored-by: Tulir Asokan <tulir@maunium.net>
28 lines
1.5 KiB
Markdown
28 lines
1.5 KiB
Markdown
# Usercontent
|
|
|
|
While decryption itself is safe to be done without a sandbox,
|
|
letting the browser and user interact with the resulting data may be dangerous,
|
|
previously `usercontent.riot.im` was used to act as a sandbox on a different origin to close the attack surface,
|
|
it is now possible to do by using a combination of a sandboxed iframe and some code written into the app which consumes this SDK.
|
|
|
|
Usercontent is an iframe sandbox target for allowing a user to safely download a decrypted attachment from a sandboxed origin where it cannot be used to XSS your Element session out from under you.
|
|
|
|
Its function is to create an Object URL for the user/browser to use but bound to an origin different to that of the Element instance to protect against XSS.
|
|
|
|
It exposes a function over a postMessage API, when sent an object with the matching fields to render a download link with the Object URL:
|
|
|
|
```json5
|
|
{
|
|
imgSrc: "", // the src of the image to display in the download link
|
|
imgStyle: "", // the style to apply to the image
|
|
style: "", // the style to apply to the download link
|
|
download: "", // download attribute to pass to the <a/> tag
|
|
textContent: "", // the text to put inside the download link
|
|
blob: "", // the data blob to wrap in an object url and allow the user to download
|
|
}
|
|
```
|
|
|
|
If only imgSrc, imgStyle and style are passed then just update the existing link without overwriting other things about it.
|
|
|
|
It is expected that this target be available at `usercontent/` relative to the root of the app, this can be seen in element-web's webpack config.
|