fix(desktop): allow custom URL schemes

Author: DIYgod

apps/desktop/layer/main/src/ipc/services/integration.test.ts

@@ -1,7 +1,7 @@
 import fsp from "node:fs/promises"
 import os from "node:os"
 
-import { shell } from "electron"
+import { dialog, shell } from "electron"
 import path from "pathe"
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
 
@@ -14,6 +14,9 @@ vi.mock("electron", () => ({
   shell: {
     openExternal: vi.fn(),
   },
+  dialog: {
+    showMessageBox: vi.fn(),
+  },
 }))
 
 vi.mock("electron-ipc-decorator", () => ({
@@ -73,10 +76,13 @@ describe("IntegrationService", () => {
 
   describe("openURLScheme", () => {
     const openExternalMock = vi.mocked(shell.openExternal)
+    const showMessageBoxMock = vi.mocked(dialog.showMessageBox)
 
     beforeEach(() => {
       openExternalMock.mockReset()
       openExternalMock.mockResolvedValue()
+      showMessageBoxMock.mockReset()
+      showMessageBoxMock.mockResolvedValue({ checkboxChecked: false, response: 0 })
     })
 
     it("rejects input that cannot be parsed as a URL", async () => {
@@ -110,6 +116,7 @@ describe("IntegrationService", () => {
         await expect(service.openURLScheme(dangerousScheme)).rejects.toThrow(
           /not allowed|disallowed|not permitted/i,
         )
+        expect(showMessageBoxMock).not.toHaveBeenCalled()
         expect(openExternalMock).not.toHaveBeenCalled()
       },
     )
@@ -133,7 +140,32 @@ describe("IntegrationService", () => {
       await expect(service.openURLScheme(allowedScheme)).resolves.toEqual({
         success: true,
       })
+      expect(showMessageBoxMock).not.toHaveBeenCalled()
       expect(openExternalMock).toHaveBeenCalledWith(allowedScheme)
     })
+
+    it.each([
+      ["logseq://x-callback-url/open?title=Test"],
+      ["my-app+folo.v2://open?title=Test"],
+      ["MYAPP://open"],
+      ["file-helper://open"],
+    ])("permits user-defined integration scheme %s", async (customScheme) => {
+      const service = new IntegrationService()
+
+      await expect(service.openURLScheme(customScheme)).resolves.toEqual({
+        success: true,
+      })
+      expect(showMessageBoxMock).toHaveBeenCalledOnce()
+      expect(openExternalMock).toHaveBeenCalledWith(customScheme)
+    })
+
+    it("does not open a user-defined integration scheme when confirmation is canceled", async () => {
+      showMessageBoxMock.mockResolvedValue({ checkboxChecked: false, response: 1 })
+      const service = new IntegrationService()
+
+      await expect(service.openURLScheme("logseq://open")).rejects.toThrow(/not opened/i)
+      expect(showMessageBoxMock).toHaveBeenCalledOnce()
+      expect(openExternalMock).not.toHaveBeenCalled()
+    })
   })
 })

apps/desktop/layer/main/src/ipc/services/integration.ts

@@ -1,10 +1,11 @@
 import { existsSync } from "node:fs"
 import fsp from "node:fs/promises"
 
-import { shell } from "electron"
+import { dialog, shell } from "electron"
 import { IpcMethod, IpcService } from "electron-ipc-decorator"
 import path from "pathe"
 
+import { t } from "~/lib/i18n"
 import { store } from "~/lib/store"
 import { logger } from "~/logger"
 
@@ -81,14 +82,7 @@ export async function saveMediaToEagle(input: SaveToEagleInput): Promise<any> {
   }
 }
 
-// Allowlist of URL scheme protocols that `openURLScheme` is permitted to hand
-// off to `shell.openExternal`. The list intentionally covers the integrations
-// shipped in the UI (Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus
-// generic web/mail schemes, while excluding dangerous protocols such as
-// `file:`, `smb:`, `ms-msdt:`, `search-ms:`, `jar:`, `res:`, `javascript:`,
-// `data:`, `vbscript:`, which have known abuse chains when invoked from
-// untrusted content.
-const ALLOWED_URL_SCHEME_PROTOCOLS = new Set<string>([
+const BUILT_IN_URL_SCHEME_PROTOCOLS = new Set<string>([
   "http",
   "https",
   "mailto",
@@ -100,8 +94,39 @@ const ALLOWED_URL_SCHEME_PROTOCOLS = new Set<string>([
   "x-devonthink",
 ])
 
-function isAllowedURLSchemeProtocol(protocol: string): boolean {
-  return ALLOWED_URL_SCHEME_PROTOCOLS.has(protocol)
+// Protocols that must never be handed to `shell.openExternal`, even after user
+// confirmation. Matches are exact so custom protocols such as `file-helper`
+// remain usable.
+const DISALLOWED_URL_SCHEME_PROTOCOLS = new Set<string>([
+  "data",
+  "file",
+  "jar",
+  "javascript",
+  "ms-msdt",
+  "res",
+  "search-ms",
+  "smb",
+  "vbscript",
+])
+
+function isDisallowedURLSchemeProtocol(protocol: string): boolean {
+  return DISALLOWED_URL_SCHEME_PROTOCOLS.has(protocol)
+}
+
+async function confirmUserDefinedURLScheme(protocol: string): Promise<boolean> {
+  const result = await dialog.showMessageBox({
+    type: "warning",
+    title: t("dialog.openExternalApp.title"),
+    message: t("dialog.openExternalApp.message", {
+      url: `${protocol}://`,
+      interpolation: { escapeValue: false },
+    }),
+    buttons: [t("dialog.open"), t("dialog.cancel")],
+    defaultId: 1,
+    cancelId: 1,
+  })
+
+  return result.response === 0
 }
 
 export class IntegrationService extends IpcService {
@@ -406,14 +431,9 @@ ${content}
 
     try {
       // Parse and validate the protocol up-front. `shell.openExternal` will
-      // happily dispatch any scheme the OS has registered a handler for,
-      // including `file://`, `smb://`, `ms-msdt:`, `search-ms:`, `jar:`,
-      // `res:`, etc. Several of those have well-documented exploit chains
-      // (NTLM credential theft over SMB, MSDT/Follina RCE on Windows,
-      // local-file disclosure via file://). The Electron docs explicitly
-      // warn against passing untrusted URLs to `shell.openExternal`, so we
-      // enforce a strict allowlist of schemes that the integrations UI is
-      // intended to support.
+      // happily dispatch any scheme the OS has registered a handler for. Keep
+      // known dangerous protocols blocked while allowing user-configured app
+      // schemes such as `logseq://` or `ulysses://`.
       let protocol: string
       try {
         protocol = new URL(scheme).protocol.replace(/:$/, "").toLowerCase()
@@ -425,10 +445,15 @@ ${content}
         throw new Error("Invalid URL scheme format. Must include protocol (e.g., 'app://')")
       }
 
-      if (!isAllowedURLSchemeProtocol(protocol)) {
-        throw new Error(
-          `URL scheme "${protocol}://" is not allowed. Allowed schemes: ${[...ALLOWED_URL_SCHEME_PROTOCOLS].sort().join(", ")}.`,
-        )
+      if (isDisallowedURLSchemeProtocol(protocol)) {
+        throw new Error(`URL scheme "${protocol}://" is not allowed.`)
+      }
+
+      if (
+        !BUILT_IN_URL_SCHEME_PROTOCOLS.has(protocol) &&
+        !(await confirmUserDefinedURLScheme(protocol))
+      ) {
+        throw new Error(`URL scheme "${protocol}://" was not opened.`)
       }
 
       // Log URL scheme execution (mask sensitive data)