[ AutoFiC ] Security Patch 2025-07-31

packages/client/src/rtc/signal.ts

@@ -27,6 +27,13 @@ export const createWebSocketSignalChannel = (opts: {
 
   ws.addEventListener('message', (e) => {
     try {
+      // Check the origin of the message
+      const trustedOrigins = ['https://trusted-origin.com']; // Example trusted origin
+      if (!trustedOrigins.includes(new URL(e.origin).origin)) {
+        logger('warn', 'Received message from untrusted origin', e.origin);
+        return;
+      }
+
       const message =
         e.data instanceof ArrayBuffer
           ? SfuEvent.fromBinary(new Uint8Array(e.data))

packages/client/src/timers/index.ts

@@ -23,6 +23,9 @@ class TimerWorker {
       const script = URL.createObjectURL(blob);
       this.worker = new Worker(script, { name: 'str-timer-worker' });
       this.worker.addEventListener('message', (event) => {
+        if (event.origin !== window.location.origin) {
+          return; // Ignore messages from untrusted origins
+        }
         const { type, id } = event.data as TimerWorkerEvent;
         if (type === 'tick') {
           this.callbacks.get(id)?.();

packages/client/src/timers/worker.ts

@@ -3,6 +3,9 @@ import type { TimerWorkerEvent, TimerWorkerRequest } from './types';
 const timerIdMapping = new Map<number, NodeJS.Timeout>();
 
 self.addEventListener('message', (event: MessageEvent) => {
+  // Validate the origin of the message
+  if (event.origin !== 'https://trusted-origin.com') return;
+
   const request = event.data as TimerWorkerRequest;
 
   switch (request.type) {

sample-apps/react-native/ringing-tutorial/constants/Users.ts

@@ -8,19 +8,16 @@ export const Users: UserWithToken[] = [
   {
     id: 'user1',
     name: 'User 1',
-    token:
-      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoidXNlcjEifQ.eVDaUZJ7LL3jByFej17Jpuf7arq66go_J5DLbrsGyXs',
+    token: process.env.USER1_TOKEN || '',
   },
   {
     id: 'user2',
     name: 'User 2',
-    token:
-      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoidXNlcjIifQ.wm4Os9GgiqclP2ms_8kD_ROFbEy2-FhdkLBbJBDQidM',
+    token: process.env.USER2_TOKEN || '',
   },
   {
     id: 'user3',
     name: 'User 3',
-    token:
-      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoidXNlcjMifQ.cVkIRGhvsnkSoNd2f5DHDLdEK7q-j1z2XD7XiWJhXRM',
+    token: process.env.USER3_TOKEN || '',
   },
 ];

sample-apps/react-native/ringing-tutorial/utils/setPushConfig.ts

@@ -6,7 +6,7 @@ import { AndroidImportance } from '@notifee/react-native';
 import AsyncStorage from '@react-native-async-storage/async-storage';
 import { Users } from '../constants/Users';
 
-const API_KEY = 'par8f5s3gn2j';
+const API_KEY = process.env.STREAM_API_KEY;
 
 export function setPushConfig() {
   StreamVideoRN.setPushConfig({