cadence/out-of-your-element
cadence/out-of-your-element
4
10
Fork 7
Code Issues 15 Pull requests 3 Releases 32 Activity
32 releases 32 tags
  • v3.8.2 826cd63a8e

    v3.8.2 Stable

    cadence released this 2026-11-04 10:23:31 +00:00 | 2 commits to main since this release

    Note: npm will currently announce security vulnerabilities while updating. The packages with listed vulnerabilities are only used for testing and are not used while the bridge is running. Do not run npm audit fix --force, it will break packages. You have been warned.

    Features

    • a3f3f6e Reduce intensity of URL previews on messages

      Assuming I implemented this correctly, here's the details:

      • OOYE will still mirror Discord generated embeds for messages
      • Messages originating from Discord (whether regular messages or mirrored embeds) will tell your client to not render additional URL previews
        • EXCEPT for YouTube videos and Tenor/Klipy GIFs, which should have exactly one Matrix url preview (so that you may be able to see the video or animated GIF inline)
      • Also for messages originating from Matrix that generate mirrored embeds, it should tell your client to not render additional URL previews on those embeds
      • If you turn off Discord generated embeds through the web interface, there's no changes to the previous behaviour. OOYE won't mirror anything and your client is free to show its own previews.

      If you think this new approach is still not adequate, please give feedback and suggest an alternative. I can easily change it right now but I will lock in the new behaviour by next release.

    Security fixes

    • 1a1a449 Request unknown files via homeserver (SSRF prevention)
      • If you have servers on your local network that take actions or leak data on unauthenticated GET requests (e.g. many home routers), make sure your homeserver's url preview denylist is set up correctly!
      • If your homeserver denies url preview entirely, you will have to manually screen origins and add them to PREAPPROVED_ORIGINS. I've included suitable list to start with.
    • ad8db55 Route more things
    • 46ee816 matrix: stricter mxc validation (thank you l1s5 for discovery and fix)
    • 826cd63 matrix: stricter mxid validation (thank you again l1s5 for discovery and fix)

    Fixes

    • c51a5ce 95271d4 Fix points of HTML injection in d2m converter (thank you yet again l1s5 for discovery and fix)
      • This is not a security issue as Matrix clients already sanitise HTML messages.
    • 01ee652 9a41796 web: add CSRF guards and cookie policy (thank you yet again l1s5 for discovery and fix)
    • ea35e1f Update Temporal polyfill
    Downloads