Skip to content

electron: allow the redirect from voice.google.com/about so WAA can init - #23

Open
jacobjeger wants to merge 1 commit into
mautrix:mainfrom
jacobjeger:fix-waa-init-redirect
Open

electron: allow the redirect from voice.google.com/about so WAA can init#23
jacobjeger wants to merge 1 commit into
mautrix:mainfrom
jacobjeger:fix-waa-init-redirect

Conversation

@jacobjeger

Copy link
Copy Markdown

The problem

voice.google.com/about now redirects to workspace.google.com/products/voice/, which is not in staticAllowedURLs. onBeforeRequest therefore cancels the window's own navigation:

electron: Failed to load URL: https://workspace.google.com/products/voice/
          with error: ERR_BLOCKED_BY_CLIENT

loadURL rejects, so waiting_for_init is never printed and inited stays false. Every later signature request then takes the init branch in processIPC and fails:

[WARN] Timed out waiting for signature ... error="request timed out"
[WARN] Received error ... error="invalid init data"
[ERRO] Failed to generate signature ... error="invalid init data"

Messages still send, but with no WAA signature at all, which is the documented path to HTTP 429.

Why this is easy to miss

Electron launches and logs normally — it just never finishes init. From the outside it looks like a working setup. This may explain #4, #7 and #9, where people installed Electron and still saw 429s (including electron status: ok).

The fix

Allow top-level navigations anywhere under google.com, so a future redirect change cannot break init again. Sub-resources stay restricted to the WAA script alone, as before.

A narrower fix would be adding the single new URL to staticAllowedURLs — happy to switch to that if you would rather keep the allowlist strict. The diagnosis matters more than my particular patch.

Verification

Deployed on a self-hosted bridge. Before: ERR_BLOCKED_BY_CLIENT then invalid init data on every send. After: Waa ping successful, and no invalid init data or ERR_BLOCKED_BY_CLIENT since.

voice.google.com/about now redirects to workspace.google.com/products/voice/, which
is not in staticAllowedURLs. onBeforeRequest therefore cancels the window own
navigation and Electron logs:

    Failed to load URL: https://workspace.google.com/products/voice/
                        with error: ERR_BLOCKED_BY_CLIENT

loadURL rejects, so "waiting_for_init" is never printed and `inited` stays false.
Every later signature request then takes the init branch in processIPC and fails with
"invalid init data", or times out waiting. Messages are still sent, but with no WAA
signature at all, which is the documented path to HTTP 429.

This is easy to mistake for Electron not being installed: it launches fine and logs
normally, it just never finishes init. It likely explains the reports in mautrix#4, mautrix#7 and mautrix#9
where people installed Electron and still got 429s.

Allow top-level navigations anywhere under google.com so a future redirect change
cannot break init again; sub-resources stay restricted to the WAA script alone.
A narrower fix would be to add the single new URL to staticAllowedURLs -- happy to
switch to that if you prefer to keep the allowlist strict.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants