Joplin sends bare download links to the default browser for application updates, which may lead to undefined behavior.

[elsiehupp]

Environment

Joplin version: Joplin 2.6.???

Note: this was when I installed 2.7.13, so it was on whatever was the previous version, but this has happened for several updates in a row.

Platform: macOS 12.1
OS specifics: Running on Intel (idk if that matters)

Steps to reproduce

1. Joplin prompts you to download a new version.
2. When I click the ”Download” button, the download URL is routed through my default browser, Choosy, to the Unite site-specific browser I have set up for *.github.com domain domains.
3. Unite is extremely janky, and the "Save" dialog for the DMG looks like this (it prepends the filename with an =):

Relying on an external browser for bare download links (e.g. for updates) is prone to undefined behavior such as the above.

Describe what you expected to happen

Joplin would ideally use Electron’s internal update mechanism, though this only works on Windows and macOS.

Alternately, Joplin could use Electron to handle downloads more generally, in particular its own updates. For instance, you could probably use the electron-dl NPM package.

As a further fallback, instead of sending a bare download link, Joplin could open a link to a web page—such as joplinapp.org/download—in the default browser, and in turn the page could be used to route the update download.

Logfile

N/A

[laurent22]

That's odd, and it's been happening fpr several recent updates? Could it be due to a browser extension? For example, if you change your default browser, does it still happen?

[elsiehupp]

My default browser is Choosy, but I’m not sure why that would have any effect on the “Save” dialogue, given that it’s entirely within Joplin.

Anyway, I can’t easily test this again until there’s another update.

[laurent22]

How is that "entirely within Joplin" when it's literally entirely within the browser, which opens the URLs and downloads the file. But whatever, let's see on the next update.

[CalebJohn]

@elsiehupp, when you initiate an update from within Joplin, all Joplin does is open the download link from your default browser.

In this case your screenshot appears to be from safari.
I performed the update from a macOS computer a few days ago with Firefox as the default browser. It didn't have the same issue, so I also suspect this is either a bug with your default browser or a browse plugin/configuration issue.

[elsiehupp]

I was mistaken about how the download was being handled, and it appears it was going through the Unite site-specific browser I set up for *.github.com links. Unite is admittedly rather janky—I feel like I may have run into this same problem with other downloads—and more broadly illustrates the problems involved with relying on bare download links for software updates.

I have updated the title and text of this Issue accordingly in order to better reflect the underlying situation.

EDIT: I just added a reference to Electron’s internal auto update mechanism (which was not in my initial revision).

[laurent22]

Ok we can close the issue then if it's a bug in Unite.

[elsiehupp]

@laurent22 Did you actually read my updated title and description? The problem is that Joplin sends a bare download link (i.e. not a link to a renderable web page) to the default browser, which can easily lead to undefined behavior.

If you’d prefer I can use the following (copied from the updated description) as the basis of a “feature request” (whatever that means), rather than a “bug report” (whatever that means), but I’d rather you acknowledge what I wrote first rather than waste my time on unwelcome quality assurance.

Describe what you expected to happen

Joplin would ideally use Electron’s internal update mechanism, though this only works on Windows and macOS.

Alternately, Joplin could use Electron to handle downloads more generally, in particular its own updates. For instance, you could probably use the electron-dl NPM package.

As a further fallback, instead of sending a bare download link, Joplin could open a link to a web page—such as joplinapp.org/download—in the default browser, and in turn the page could be used to route the update download.

[CalebJohn]

Just FYI, there is a project plan for better application updates.

[elsiehupp]

@CalebJohn cool, thank you for sharing the link!