Restarting Mac / quitting Safari breaks file opening from popup

[raxelbrof]

Hi,

Running Safari Version 13.1.1 (13609.2.9.1.3) on macOS High Sierra 10.13.6, and whenever you quit Safari, you lose the ability to access your Tamperish modifications from the Tamperish button in Safari - you end up with this error message:

The only solution appears to be going through a dance of disabling Tamperish, renaming the Tampers folder, reenabling Tamperish and restarting Safari - but then it breaks again as soon as you quit Safari the next time.

[raxelbrof]

Followup:

Correcting the problem requires at a minimum: moving the Tampers folder to a different location, then reselecting it in the Tamperish app, then restarting Safari.

Next time the user quits Safari, the permissions (assuming it's a sandboxing issue) are lost again.

[raxelbrof]

Further followup:

Reselecting the Tampers folder in the same location would also appear to work.

Whatever the problem, it appears that the permission for the plugin to read / launch an application (Espresso - not a Mac App Store app in this case), expires with Safari's session.

[username0x0a]

Hi @raxelbrof, thanks for your report!

It certainly is a sandbox issue. Whatever it's caused by, it looks like the secure bookmark to a Tampers folder is somehow being expired by relaunching Safari. Weird thing is the expiration only applies to some functionality (ability to open the folder or a specific file), not altogether as Tamper files are still properly loaded and injected into the page.

[raxelbrof]

More weirdness, after the machine had been asleep overnight, the Tamperish button kept reporting that there was no folder set, had to switch the plugin off and on a couple of times, and re-set the Tampers folder a few times to get it to stick and show the css file I'm using in the button menu.

[raxelbrof]

Confirmation 2nd day in a row, after waking from sleep overnight, Tamperish button reports no no folder set.

[username0x0a]

I might have this issue fixed hopefully, an update can be expected soon! 🙌

[raxelbrof]

Homer Simpson Woo-Hoo animated gif

[username0x0a]

I only hope the Sandbox won't cripple this solution in extraordinary new ways. 🤦

[username0x0a]

Tamperish 1.1 update with fix is processing for App Store. 👍

[raxelbrof]

Hate to say it, but it seems to have sprung up again for me. Right now, from a reboot, the Tamperish HTML file can't be opened from within Safari, unless I Quit Safari, then open the Tamperish app, Change the Tampers folder location to the same folder, quit Tamperish, then launch Safari.

The only thing I can think of that has changed, is I rebooted with SIP disabled in order to install new SwitchResX custom virtual screen resolutions, then reenabled SIP.

I've reinstalled Tamperish since, and it doesn't seem to have changed things.

[username0x0a]

v1.2 is waiting for review currently and I hope it will finally address the issue. 🙏

I can't really say it's easy to navigate with security scope permission on Tampers folder with sandbox, even Full Disk Access can't be of any help here as it's not considered with App Store apps (🤯) (and the documentation of this is really vague with different scenarios an app can work in), but I presume the issue only was with handling the folder permission when performing the Open action while Read action on Tamper files was handled correctly as those were successfully applied on related sites.

I'll be happy for any feedback! 🙌

[raxelbrof]

I can sympathise with the "you're doing something weird, so no help for you" experience with making stuff reliant on Apple's techs.

Looking forward to seeing the update.

[username0x0a]

It's not entirely weird, just somehow not a major use case and touching security/privacy so making both well usable APIs as well as implementing it properly is not a task of ease. I'm not really blaming Apple here (except for the lack of more detailed documentation) 'cause it's very probably possible (if the fix really works reliably now) to do; there are way bigger concerns in Apple's view of World I can see. 😄

I'd be very glad if someone finds a couple of minutes to try both restarting Safari and Mac scenarios, but I hope this inconvenience is about to go for good.

[raxelbrof]

I'll give it a go once the update is live - though I've noticed the Mac App Store app doesn't notify me of updated for Safari extension apps.

[username0x0a]

The Mac App Store review is really taking insanely long so I've prepared a notarised build here on GitHub, too:

https://github.com/username0x0a/Tamperish/releases/tag/1.2

👍

[username0x0a]

Tamperish v1.2 is finally out so I hope I can squash this bug once forever. 🙌😎