fix: load room history on insecure origins - #41708
Open
Hardik180704 wants to merge 1 commit into
Open
Conversation
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
🦋 Changeset detectedLatest commit: 935fd12 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (2)**/*.{ts,tsx,js}📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
Files:
**/*.spec.ts📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
Files:
🧠 Learnings (8)📚 Learning: 2026-03-16T21:50:37.589ZApplied to files:
📚 Learning: 2026-02-10T16:32:42.586ZApplied to files:
📚 Learning: 2026-05-11T20:30:35.265ZApplied to files:
📚 Learning: 2026-02-24T19:22:48.358ZApplied to files:
📚 Learning: 2026-02-26T19:25:44.063ZApplied to files:
📚 Learning: 2026-02-26T19:25:44.063ZApplied to files:
📚 Learning: 2026-03-06T18:10:15.268ZApplied to files:
📚 Learning: 2026-05-06T12:21:44.083ZApplied to files:
🔇 Additional comments (3)
WalkthroughRoom history request identifiers now use ChangesRoom history request identifier
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 3 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/meteor/client/lib/RoomHistoryManager.spec.ts">
<violation number="1" location="apps/meteor/client/lib/RoomHistoryManager.spec.ts:51">
P3: The regression test only covers the first (non-queued) getMore call, where the Random.id() emitter key is generated but discarded; the queued path — a second getMore while one is in flight, where requestId is pushed into requestsList and routed via this.once(requestId, done) — is where the internal identifier actually matters and is left untested. Consider adding a second concurrent getMore to assert the queued request completes (Random.id() key routes the emitter event), and/or assert that messages are persisted via storeMany and isLoading returns to false.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
|
||
| try { | ||
| await expect(RoomHistoryManager.getMore('room-id')).resolves.toBeUndefined(); | ||
| expect(mockedCallWithErrorHandling).toHaveBeenCalledWith('loadHistory', 'room-id', undefined, 50, undefined, false); |
Contributor
There was a problem hiding this comment.
P3: The regression test only covers the first (non-queued) getMore call, where the Random.id() emitter key is generated but discarded; the queued path — a second getMore while one is in flight, where requestId is pushed into requestsList and routed via this.once(requestId, done) — is where the internal identifier actually matters and is left untested. Consider adding a second concurrent getMore to assert the queued request completes (Random.id() key routes the emitter event), and/or assert that messages are persisted via storeMany and isLoading returns to false.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/lib/RoomHistoryManager.spec.ts, line 51:
<comment>The regression test only covers the first (non-queued) getMore call, where the Random.id() emitter key is generated but discarded; the queued path — a second getMore while one is in flight, where requestId is pushed into requestsList and routed via this.once(requestId, done) — is where the internal identifier actually matters and is left untested. Consider adding a second concurrent getMore to assert the queued request completes (Random.id() key routes the emitter event), and/or assert that messages are persisted via storeMany and isLoading returns to false.</comment>
<file context>
@@ -0,0 +1,57 @@
+
+ try {
+ await expect(RoomHistoryManager.getMore('room-id')).resolves.toBeUndefined();
+ expect(mockedCallWithErrorHandling).toHaveBeenCalledWith('loadHistory', 'room-id', undefined, 50, undefined, false);
+ } finally {
+ Object.defineProperty(globalThis.crypto, 'randomUUID', { configurable: true, value: originalRandomUUID });
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
crypto.randomUUID()call inRoomHistoryManagerwith Rocket.Chat's browser-safeRandom.id()utilitycrypto.randomUUIDis unavailable@rocket.chat/meteorRoot cause
RoomHistoryManager.queue()generated an internal emitter key withcrypto.randomUUID(). Browsers expose that API only in secure contexts, so opening Rocket.Chat over plain HTTP on a non-localhost origin rejected the history-loading promise beforeloadHistorycould run.The queue only requires a collision-resistant internal identifier, not UUID formatting.
@rocket.chat/randomis already used throughout the client and generates IDs withcrypto.getRandomValues()when available, with its established fallback otherwise.User impact
Message history can load again for self-hosted workspaces accessed through non-secure HTTP origins, while secure-origin behavior remains unchanged.
Validation
TypeError: crypto.randomUUID is not a functionyarn workspace @rocket.chat/meteor .testunit:jest --selectProjects client --runInBand client/lib/RoomHistoryManager.spec.tsyarn workspace @rocket.chat/random test --runInBandyarn eslint apps/meteor/app/ui-utils/client/lib/RoomHistoryManager.ts apps/meteor/client/lib/RoomHistoryManager.spec.tsyarn changeset statusThe full Meteor typecheck was also attempted; current
developreports unrelated existing errors in thread drafts, TOTP/OAuth endpoint typings, file-upload typings, and other untouched areas. No error referenced the changed files.Fixes #41666
Summary by CodeRabbit
Bug Fixes
crypto.randomUUIDis unavailable.Tests
crypto.randomUUID.