MSC4095: Bundled URL previews

[tulir]

Rendered

Implementations:

• Beeper Desktop, Android and iOS render incoming bundled preview data, and bundle previews in outgoing messages using data from the /preview_url endpoint.
• The next-gen Beeper Android client also generates preview data locally instead of asking the homeserver to do it.
• mautrix-{whatsapp,signal,imessage} and beeper-imessage bridge preview data in both directions.
• mautrix-{discord,telegram,twitter,instagram} bridge preview data from the remote network to Matrix.

Signed-off-by: Tulir Asokan tulir@maunium.net

[ara4n]

I think it's worth calling out some more explicit security concerns here:

If the sender doen't use its server's /preview_url endpoint as a helper:

• This will leak the sending client's IP to the URL they are previewing.
• The client will need to be careful not to let itself get pwned by malicious content at that URL (e.g. XML parsing exploits in the HTTP library; billion lol attacks...)
• The client should be very careful not to preview URLs provided by other users - e.g. when replying to a message or quoting it, to stop an attacker sending a malicious URL to a user in order to discover their IP or otherwise pwn them.
  • Concretely, we don't want a world where you receive spam saying "Click reply to this message to win $20M!!! https://evil.com", where the act of replying generates a preview to https://evil.com which then harvests your IP and serves you a malformed image in its URL preview thumbnail which then pwns your app
  • Another concrete attack could be sending a user a malicious URL (hidden in a hyperlink, perhaps? or hidden by mangled UTF sequences) which hits an RFC1918 address on their network to attack them - https://192.168.0.1/ or whatever, and encouraging the user to reply to or quote the msg

One might also want to require an allowlist of IPs the sender's spider is allowed to hit anyway, to try to avoid disasters where users are social-engineered into sending malicious URLs in general, which they never click on, but still get 'clicked on' by the URL previewer, causing chaos.

I'm sure there are a bunch more attack vectors here too...