Route chatbot-support mailto through Help WebView log-attach flow#5262
Open
joashrajin wants to merge 1 commit into
Open
Route chatbot-support mailto through Help WebView log-attach flow#5262joashrajin wants to merge 1 commit into
joashrajin wants to merge 1 commit into
Conversation
The AI widget on support.pocketcasts.com now uses mailto:chatbot-support@pocketcasts.com so AI-originated tickets land in a separate inbox. Without this change, the WebView client at HelpPage.kt did not recognize that address and the mailto fell through to the system email composer with no debug.txt attached. - Add chatbot-support@pocketcasts.com to the recognized support recipient set in HelpPage.kt - Tighten mailto matching from prefix-startsWith (which would also match attacker-controlled mailto:support@pocketcasts.com.evil.com) to exact recipient equality - Thread the parsed recipient through HelpWebViewClient -> HelpViewModel.getSupportIntent -> Support.shareLogs so the intent's EXTRA_EMAIL reflects the URL the user tapped - Other shareLogs callers (LogsViewModel, StatusViewModel, HelpViewModel feedback path, wear logs) continue to default to support@pocketcasts.com via parameter defaults
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the in-app Help WebView mailto interception so that “Ask AI” contact links can route to a new chatbot-support@pocketcasts.com inbox while still attaching debug logs, without changing behavior for existing support/log-sharing entry points.
Changes:
- Make the support email recipient configurable through
HelpPage -> HelpViewModel -> Support.shareLogs. - Tighten Help WebView mailto handling to exact-recipient allowlisting (and add
chatbot-support@pocketcasts.com). - Keep the Help-page load error “Contact support” button targeting
support@pocketcasts.com.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| modules/services/repositories/src/main/java/au/com/shiftyjelly/pocketcasts/repositories/support/Support.kt | Adds optional recipient parameter to shareLogs() and uses it for Intent.EXTRA_EMAIL. |
| modules/features/settings/src/main/java/au/com/shiftyjelly/pocketcasts/settings/viewmodel/HelpViewModel.kt | Threads optional recipient through getSupportIntent() to Support.shareLogs(). |
| modules/features/settings/src/main/java/au/com/shiftyjelly/pocketcasts/settings/HelpPage.kt | Parses mailto recipient in HelpWebViewClient, allowlists recipients (including chatbot-support), and passes recipient into support flow. |
Contributor
Author
|
Some context on p1777549631343759/1774527906.406489-slack-C06DGE41ENN |
Draft
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Ask AI widget on
support.pocketcasts.comis moving frommailto:support@pocketcasts.comtomailto:chatbot-support@pocketcasts.comso AI-originated tickets land in a separate inbox.Today, when a user taps the widget's "contact us here" link inside the in-app Help WebView, HelpWebViewClient intercepts the mailto and routes it through
Support.shareLogs(), which builds anIntent.ACTION_SENDwithdebug.txtattached. The to-address is hardcoded tosupport@pocketcasts.com, and the allowlist of mailto URLs only containssupport@shiftyjelly.comandsupport@pocketcasts.com. So once the widget switches tochatbot-support@, the WebView would stop recognizing the link, fall through toonTapUri(), and the user would email the chatbot inbox without debug logs attached.This PR makes the recipient address configurable end-to-end while preserving existing behaviour for every other caller of
shareLogs().Changes
HelpPage.kt— replaced the prefix-matchcontactSupportActionlist with an exact-recipientSet<String>(supportRecipients) that now includeschatbot-support@pocketcasts.com. Parses the recipient from the matched mailto URL and passes it through. Falls back toonTapUri()for any mailto whose recipient isn't in the set. TheWebViewError"Contact support" button (shown when the help page fails to load) explicitly usessupport@pocketcasts.com.HelpViewModel.getSupportIntent()— accepts an optionalrecipient: String(defaultsupport@pocketcasts.com) and forwards it.Support.shareLogs()— adds an optionalrecipient: Stringparameter (defaultsupport@pocketcasts.com) and uses it forIntent.EXTRA_EMAILinstead of the hardcoded address. Other callers (LogsViewModel,StatusViewModel, thegetFeedbackIntentpath, andemailWearLogsToSupportIntent) are unaffected via the default.Security note
The previous
contactSupportAction.any { url.startsWith(it) }check matched by prefix, somailto:support@pocketcasts.com.evil.comwould also match. This was harmless before because the to-address was hardcoded — but parsing the recipient from the URL would have made it exploitable. This PR tightens to exact-equality matching against thesupportRecipientsset.Test plan
chatbot-support@pocketcasts.comin the To field anddebug.txtattached.support@pocketcasts.comanddebug.txtattached (regression check).support@pocketcasts.com(regression check).support@pocketcasts.com(regression check).supportRecipientsand confirm it falls through to the system email composer (no log attachment, no crash).Related
Coordinated with the support team's move to a dedicated
chatbot-support@pocketcasts.cominbox for AI-originated tickets. The widget HTML change (swapping the renderedmailto:href) is being made separately on the support site.Draft until the widget swap is timed.