Re: [BUG] Org-protocol bookmarklets in Firefox behaving badly after recent upgrade [9.6.15 (release_9.6.15 @ /usr/share/emacs/29.4/lisp/org/)]

[Max Nikulin <manikulin@gmail.com>]

On 12/12/2024 15:12, Rehan Deen wrote:
> on the webpage https://orgmode.org/, Emacs is able to capture the link
> and title ("Org mode for GNU Emacs") as desired, but the browser
> displays a blank page with the following text:
> 
>      org-protocol://store-link?url=https%3A%2F%2Forgmode.org%2F&title=Org+mode+for+GNU+Emacs
> 
> I have to hit refresh to redisplay the original webpage.

Have you considered reporting a bug to Firefox?

I have tried year old versions of Chromium and Firefox and have realized 
that e.g. javascript:a="test" consistently replaces document content. 
Chromium still discards expression value in the case of assignment to 
"location". So the change is specific to Firefox (including ESR channel) 
and perhaps an unintentional side effect of another fix, likely a 
security one.

> Interestingly, the `org-capture` extension for Firefox from
> https://github.com/sprig/org-capture-extension continues to work without
> producing this issue (i.e. the link is captured and the webpage
> continues to be displayed properly).

So Firefox and Chromium behavior content scripts has diverged. Chromium 
asks permission on behalf of the current web page while Firefox treats 
as the add-on permission. Likely it is a result of
<https://bugzilla.mozilla.org/1792138>
"(CVE-2023-25729) Extensions are not prompted before opening external 
schemes, leading to security issues"

Treatment of external protocol handlers is rather inconsistent in 
browsers and it is unstable.