fix: Security hardening and bug fixes for v0.3.0

Security:
- Fix PIVX wallet panic on malformed txid from explorer API
- Add path traversal prevention in Mini App ZIP extraction
- Zero-window Tauri API restriction for Mini Apps (property interception)
- Add android:allowBackup="false" to prevent sensitive data backup
- Remove HTTP scheme from Android deep links (HTTPS only)
- Add XSS prevention for image src injection in file previews

Bug fixes:
- Fix "Unknown" reply author in group chats (set npub on outgoing messages)
- Fix duplicate system events for Leave Group messages
- Prevent group creator from leaving unless they're the only member

UI:
- Add x-user icon and use it for Leave Group button

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: JSKitty

src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -16,6 +16,7 @@
         android:label="@string/app_name"
         android:theme="@style/Theme.vector"
         android:usesCleartextTraffic="${usesCleartextTraffic}"
+        android:allowBackup="false"
         android:hardwareAccelerated="true">
         <activity
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
@@ -46,7 +47,6 @@
                 <category android:name="android.intent.category.DEFAULT" />
                 <category android:name="android.intent.category.BROWSABLE" />
                 <data android:scheme="https" />
-                <data android:scheme="http" />
                 <data android:host="vectorapp.io" />
 
 

src-tauri/src/message.rs

@@ -459,6 +459,11 @@ pub async fn message(receiver: String, content: String, replied_to: String, file
             .unwrap();
     // Create persistent pending_id that will live for the entire function
     let pending_id = Arc::new(String::from("pending-") + &current_time.as_nanos().to_string());
+    // Grab our pubkey first (needed for npub in group chats)
+    let client = NOSTR_CLIENT.get().expect("Nostr client not initialized");
+    let signer = client.signer().await.unwrap();
+    let my_public_key = signer.get_public_key().await.unwrap();
+
     let msg = Message {
         id: pending_id.as_ref().clone(),
         content,
@@ -473,15 +478,11 @@ pub async fn message(receiver: String, content: String, replied_to: String, file
         pending: true,
         failed: false,
         mine: true,
-        npub: None, // Pending messages don't need npub (they're always mine)
+        npub: my_public_key.to_bech32().ok(), // Needed for group chats so replies show correct author
         wrapper_event_id: None, // Will be set when message is sent
         edited: false,
         edit_history: None,
     };
-    // Grab our pubkey first
-    let client = NOSTR_CLIENT.get().expect("Nostr client not initialized");
-    let signer = client.signer().await.unwrap();
-    let my_public_key = signer.get_public_key().await.unwrap();
 
     // Detect if this is a group chat or DM
     // First check if a chat already exists and use its type

src-tauri/src/miniapps/commands.rs

@@ -395,51 +395,62 @@ try {
 })();
 
 // Wrap Tauri's __TAURI__ API to restrict access to only allowed commands
-// We need to wait for Tauri to initialize first
-try {
-    const setupTauriRestrictions = () => {
-        if (!window.__TAURI__ || !window.__TAURI__.core) {
-            // Tauri not ready yet, try again
-            setTimeout(setupTauriRestrictions, 10);
-            return;
-        }
+// Uses property interception to ensure ZERO timing window for bypass
+(function() {
+    'use strict';
 
-        // Wrap the core invoke to reject all calls except our allowed ones
-        const originalInvoke = window.__TAURI__.core.invoke;
-        const originalChannel = window.__TAURI__.core.Channel;
-
-        window.__TAURI__.core.invoke = async (cmd, args) => {
-            // Allow our miniapp commands
-            const allowedCommands = [
-                'miniapp_get_updates',
-                'miniapp_send_update',
-                'miniapp_join_realtime_channel',
-                'miniapp_send_realtime_data',
-                'miniapp_leave_realtime_channel',
-                'miniapp_add_realtime_peer',
-                'miniapp_get_realtime_node_addr',
-                'miniapp_get_granted_permissions_for_window'
-            ];
+    const allowedCommands = [
+        'miniapp_get_updates',
+        'miniapp_send_update',
+        'miniapp_join_realtime_channel',
+        'miniapp_send_realtime_data',
+        'miniapp_leave_realtime_channel',
+        'miniapp_add_realtime_peer',
+        'miniapp_get_realtime_node_addr',
+        'miniapp_get_granted_permissions_for_window'
+    ];
+
+    function wrapTauriApi(tauriObj) {
+        if (!tauriObj || !tauriObj.core) return tauriObj;
+
+        const originalInvoke = tauriObj.core.invoke;
+        const originalChannel = tauriObj.core.Channel;
+
+        tauriObj.core.invoke = async (cmd, args) => {
             if (allowedCommands.includes(cmd)) {
-                return originalInvoke.call(window.__TAURI__.core, cmd, args);
+                return originalInvoke.call(tauriObj.core, cmd, args);
             }
             console.warn('Mini App tried to invoke blocked Tauri command:', cmd);
             throw new Error('Tauri command not available in Mini Apps: ' + cmd);
         };
 
-        // Ensure Channel class is still available (needed for realtime)
+        // Preserve Channel class (needed for realtime)
         if (originalChannel) {
-            window.__TAURI__.core.Channel = originalChannel;
+            tauriObj.core.Channel = originalChannel;
         }
 
         console.log("[MiniApp] Tauri restrictions applied");
-    };
+        return tauriObj;
+    }
 
-    // Start checking for Tauri
-    setupTauriRestrictions();
-} catch (e) {
-    console.warn("Failed to setup Tauri restrictions:", e);
-}
+    // If __TAURI__ already exists, wrap it immediately
+    if (window.__TAURI__) {
+        wrapTauriApi(window.__TAURI__);
+    }
+
+    // Intercept any future assignment to __TAURI__ (zero timing window)
+    let _tauriValue = window.__TAURI__;
+    Object.defineProperty(window, '__TAURI__', {
+        get() {
+            return _tauriValue;
+        },
+        set(newValue) {
+            _tauriValue = wrapTauriApi(newValue);
+        },
+        configurable: false,  // Prevent re-definition
+        enumerable: true
+    });
+})();
 "#;
 
 /// Get the base URL for Mini Apps based on platform

src-tauri/src/miniapps/state.rs

@@ -148,9 +148,14 @@ impl MiniAppPackage {
     pub fn get_file(&self, path: &str) -> Result<Vec<u8>, Error> {
         let file = std::fs::File::open(&self.path)?;
         let mut archive = zip::ZipArchive::new(file)?;
-        
-        // Normalize path (remove leading slash)
+
+        // Normalize path (remove leading slash) and prevent path traversal
         let normalized_path = path.trim_start_matches('/');
+
+        // Reject paths containing directory traversal sequences
+        if normalized_path.contains("..") || normalized_path.contains("\\..") {
+            return Err(Error::FileNotFound(format!("Invalid path: {}", path)));
+        }
 
         let mut zip_file = archive.by_name(normalized_path)
             .map_err(|_| Error::FileNotFound(path.to_string()))?;

src-tauri/src/pivx.rs

@@ -558,7 +558,8 @@ pub async fn build_sweep_transaction(
         preimage.push(utxos.len() as u8); // Input count
 
         for (j, other_utxo) in utxos.iter().enumerate() {
-            let other_txid = hex::decode(&other_utxo.txid).unwrap();
+            let other_txid = hex::decode(&other_utxo.txid)
+                .map_err(|e| format!("Invalid txid hex '{}': {}", &other_utxo.txid, e))?;
             preimage.extend(other_txid.iter().rev());
             preimage.extend_from_slice(&other_utxo.vout.to_le_bytes());
 
@@ -601,7 +602,8 @@ pub async fn build_sweep_transaction(
         let script_sig_len = 1 + sig_bytes.len() + 1 + pubkey_bytes.len();
 
         // Write input to signed tx
-        let txid_bytes = hex::decode(&utxo.txid).unwrap();
+        let txid_bytes = hex::decode(&utxo.txid)
+            .map_err(|e| format!("Invalid txid hex '{}': {}", &utxo.txid, e))?;
         signed_tx.extend(txid_bytes.iter().rev());
         signed_tx.extend_from_slice(&utxo.vout.to_le_bytes());
 

src/icons/x-user.svg

@@ -556,9 +556,9 @@ <h3 id="group-overview-secondary-name" class="chat-contact-with-status btn"></h3
             <span class="icon icon-add-user" style="width: 16px; height: 16px; flex-shrink: 0; position: relative; background-color: var(--icon-color-primary);"></span>
             <span style="color: white;">Invite Member</span>
           </button>
-          <button id="group-leave-btn" class="btn cancel-btn btn-bounce" style="background-color: transparent; display: none; align-items: center; gap: 6px;">
-            <span class="icon icon-trash" style="width: 16px; height: 16px; flex-shrink: 0; position: relative; background-color: var(--icon-color-danger);"></span>
-            <span style="color: var(--color-danger);">Leave Group</span>
+          <button id="group-leave-btn" class="btn cancel-btn btn-bounce" style="display: none; align-items: center; gap: 6px;">
+            <span class="icon icon-x-user" style="width: 16px; height: 16px; flex-shrink: 0; position: relative; background-color: #ff2ea9;"></span>
+            <span style="color: white;">Leave Group</span>
           </button>
         </div>
         <div class="emoji-search-container" style="padding: 10px 0px;">

src/index.html

@@ -22,6 +22,22 @@ const SUPPORTED_IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'gif', 'webp', 'tiff',
 // Video extensions supported for preview (mp4, webm, mov - except on Linux)
 const SUPPORTED_VIDEO_EXTENSIONS = ['mp4', 'webm', 'mov'];
 
+/**
+ * Validate that a string is a safe image source (data URL or blob URL)
+ * Prevents XSS via malicious src injection (e.g., javascript: protocol)
+ * @param {string} src - The source string to validate
+ * @returns {string|null} The validated src or null if invalid
+ */
+function validateImageSrc(src) {
+    if (!src || typeof src !== 'string') return null;
+    // Allow data URLs for images and blob URLs only
+    if (src.startsWith('data:image/') || src.startsWith('blob:')) {
+        return src;
+    }
+    console.warn('[file-preview] Rejected invalid image src:', src.substring(0, 50));
+    return null;
+}
+
 /**
  * Format file size in human-readable format
  * @param {number} bytes - File size in bytes
@@ -128,11 +144,12 @@ function isMiniAppExtension(ext) {
  * @param {string} fileName - Fallback file name if no Mini App info
  */
 function displayMiniAppPreview(contentArea, miniAppInfo, fileName) {
-    if (miniAppInfo && miniAppInfo.icon_data) {
+    const validatedIcon = miniAppInfo ? validateImageSrc(miniAppInfo.icon_data) : null;
+    if (validatedIcon) {
         // Show Mini App icon
         contentArea.innerHTML = `
             <div class="file-preview-image-container file-preview-miniapp">
-                <img src="${miniAppInfo.icon_data}" class="file-preview-image file-preview-miniapp-icon" alt="${miniAppInfo.name || 'Mini App'}">
+                <img src="${validatedIcon}" class="file-preview-image file-preview-miniapp-icon" alt="${escapeHtml(miniAppInfo.name || 'Mini App')}">
             </div>
         `;
     } else {
@@ -310,11 +327,12 @@ async function openFilePreview(filepath, receiver, replyRef = '') {
         // Show image preview
         const isAndroid = typeof platformFeatures !== 'undefined' && platformFeatures.os === 'android';
 
-        if (isAndroid && androidPreview) {
+        const validatedAndroidPreview = validateImageSrc(androidPreview);
+        if (isAndroid && validatedAndroidPreview) {
             // On Android, use the base64 preview we already got from cache_android_file
             contentArea.innerHTML = `
                 <div class="file-preview-image-container">
-                    <img src="${androidPreview}" class="file-preview-image" alt="Preview">
+                    <img src="${validatedAndroidPreview}" class="file-preview-image" alt="Preview">
                 </div>
             `;
         } else if (isAndroid) {
@@ -729,10 +747,11 @@ async function openFilePreviewWithBytes(bytes, fileName, ext, fileSize, receiver
         optionsArea.innerHTML = '';
     } else if (isImage) {
         // Use the preview from Rust (already a base64 data URL)
-        if (preview) {
+        const validatedPreview = validateImageSrc(preview);
+        if (validatedPreview) {
             contentArea.innerHTML = `
                 <div class="file-preview-image-container">
-                    <img src="${preview}" class="file-preview-image" alt="Preview">
+                    <img src="${validatedPreview}" class="file-preview-image" alt="Preview">
                 </div>
             `;
         } else {
@@ -890,10 +909,11 @@ async function startFileObjectCacheAndPreview(file, fileName, ext, contentArea,
         });
 
         // Display preview
-        if (result.preview) {
+        const validatedResultPreview = validateImageSrc(result.preview);
+        if (validatedResultPreview) {
             contentArea.innerHTML = `
                 <div class="file-preview-image-container">
-                    <img src="${result.preview}" class="file-preview-image" alt="Preview">
+                    <img src="${validatedResultPreview}" class="file-preview-image" alt="Preview">
                 </div>
             `;
         } else {

src/js/file-preview.js

@@ -5054,11 +5054,9 @@ async function setupRustListeners() {
                 }
             };
 
-            // Add to chat messages
-            if (chat) {
-                chat.messages.push(systemMsg);
-                eventCache.addEvent(conversation_id, systemMsg);
-            }
+            // Add to chat messages via cache (handles deduplication)
+            // Note: chat.messages and cache share the same array reference, so only use cache
+            eventCache.addEvent(conversation_id, systemMsg);
 
             // If this chat is currently open, render the system event
             if (strOpenChat === conversation_id && domChatMessages) {
@@ -9507,8 +9505,24 @@ async function renderGroupOverview(chat) {
     // Leave Group button
     domGroupLeaveBtn.style.display = 'flex';
     domGroupLeaveBtn.onclick = async () => {
-        // Confirm before leaving using popupConfirm
         const groupName = chat.metadata?.custom_fields?.name || `Group ${chat.id.substring(0, 10)}...`;
+
+        // Check if user is the group creator
+        const isCreator = myProfile && myProfile.id === chat.metadata?.creator_pubkey;
+
+        // Creators cannot leave unless they are the only member
+        if (isCreator && memberCount > 1) {
+            await popupConfirm(
+                'Cannot Leave Group',
+                'You are the creator of this group. You must remove all other members before you can leave.<br><br>Please kick all members first, then you can leave the group.',
+                true, // Notice only, no cancel button
+                '', // No input
+                'vector_warning.svg'
+            );
+            return;
+        }
+
+        // Confirm before leaving using popupConfirm
         const confirmed = await popupConfirm(
             'Leave Group',
             `Are you sure you want to leave "<b>${groupName}</b>"?<br><br>You will need to be re-invited to rejoin.`,

src/main.js

@@ -3726,6 +3726,10 @@ select:focus::-ms-value {
   mask-size: contain;
 }
 
+.icon-x-user {
+  mask-image: url("./icons/x-user.svg");
+}
+
 /* For downloaded models - make it more prominent */
 .btn-delete-model.downloaded {
   opacity: 0.8;