Subject: Re: bug#74467: 31.0.50; org-protocol emacsclient.desktop change is not fully functional

From: Björn Bidar <[email-masked]>
Date: Sun, 16 Mar 2025 16:55:26 +0200

Ihor Radchenko <[email-masked]> writes:

> Eli Zaretskii <[email-masked]> writes:
>
>>> > > ...  Ihor
>>> > > seemed to say that if this can be supported, there could be an
>>> > > alternative patch for fixing this issue, and I'd like to see that
>>> > > alternative patch to decide which one is simpler and/or more elegant.
>>> > 
>>> > See the attached.
>>> > If Emacs can handle file URIs, we can simply use %U field code.
>>>  ...
>>> Thanks, but I think we need to turn on the url-handler-mode before
>>> Emacs can visit files specified as file:// URIs.
>>
>> Ping!
>
> But isn't `url-handler-mode' doing much more than just allowing URIs in
> emacs/emacsclient arguments? Maybe one can make a more limited version
> of url-handler-mode that would be safe to enable to by default?

Are there any security issues with enabling url-handler-mode by default?

Url-handler mode adds the url-file-handler to the file-name-handler so
it can handle URI's. 

As a side-note maybe the handler should be called URI-handler instead of
URL-handler as it handlers URI types which are not URL's.

Alternatively the handler could only handle local URI's by default and
enable remote URI's if enabled.