Forced open link confirmation popup

[Zetaphor]

Description

Before a recent update, clicking a link in a PWA would open the link in my default browser (Firefox) as configured in my settings:

Now whenever I click a link I get this dialog:

And am then forced to wait 3 seconds for the open button to become enabled.

This means for every link I need to click the link, wait 3 seconds, and then click a dialog box. I understand the intention, but this option should be something the user can disable, as it breaks workflows.

Steps to Reproduce

1. Install Discord PWA
2. Click link
3. See dialog box that forces you to wait before opening the link or interacting with the PWA

Affected Websites

All websites

Environment

• Operating system: Fedora 39
• System architecture: x64
• Desktop environment: KDE 5.27
• Installation method: RPM
• PWAsForFirefox extension version: 2.91
• PWAsForFirefox native version: 2.91
• PWAsForFirefox runtime version: 121.0
• Firefox version: 120.0.1

[markcellus]

Yeah same here. I was wondering if this is a recent OS level dialog and not specific to this codebase. But you're using Fedora and I'm using Ubuntu and getting same error, so doesn't appear to be an OS-specific issue.

[filips123]

This is a change in Firefox 121, which was made to fix security vulnerability CVE-2023-6871. This was done in this patch, but the full bug report is still private, so I don't know what exactly the issue was.

I don't know yet if this popup can be disabled specifically for default browser popups. I'll check how exactly the popup works and if it's possible to hide it when opening the default browser.

---

Maybe unsafe workaround:

You can also disable the popup for all external protocols by setting the security.external_protocol_requires_permission preference to false. However, this means that any website will be able to automatically start any external protocol handler (details, which may again cause CVE-2023-6871 and other security issues.

I don't know what the latest vulnerability is about, but for example, another issue that was related to this preference a few years ago, was that opening a Zoom meeting link would automatically launch the Zoom client and join you into the meeting. Disabling this preference might again cause this behavior and other similar issues.

So, I would recommend you not to do this, but if you're aware of the risks, you can disable that preference. I hope I will be able to disable that popup specifically for opening a default browser in the future.

[MisakaImoutoWaifu]

Can confirm. I've also noticed some apps do not even open after confirming the link. Specifically a discord PWA I installed. Perhaps that is a different bug though.

[filips123]

@MisakaImoutoWaifu Do you mean that the links that you click do not open in a default browser, or that the whole PWA does not even start? Also, does this problem also happen when "open out-of-scope URLs in a default browser" is disabled?

[MisakaImoutoWaifu]

@MisakaImoutoWaifu Do you mean that the links that you click do not open in a default browser, or that the whole PWA does not even start? Also, does this problem also happen when "open out-of-scope URLs in a default browser" is disabled?

It turned out at some point the default handler changed. It was set as Firefox, but a stale reference to it. Not sure what caused it, but I think it was unrelated to this issue.

[LSeelig]

It turned out at some point the default handler changed. It was set as Firefox, but a stale reference to it.

How did you find this? I think I am having the same issue

[qupada]

Apologies everyone for the spam, just feel like I need to add a comment with the exact text of the error:

Open the https link with Firefox?

Hopefully this might help it appear in search results, took me a while to find this bug report.

[MisakaImoutoWaifu]

It turned out at some point the default handler changed. It was set as Firefox, but a stale reference to it.

How did you find this? I think I am having the same issue

Go to about:preferences and then scroll down to the "Applications" section. Change the "http" and "https" entries to your firefox binary.

[filips123]

This has been fixed in 2.10.0. The confirmation popup will no longer be shown for HTTP(S) links. Once you update to the new version, you should probably re-enable security.external_protocol_requires_permission.