Skip to content

Open w3bs:// URIs through the w3bs.org resolver - #149

Merged
ralyodio merged 1 commit into
mainfrom
feat/w3bs-scheme
Oct 20, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/w3bs-scheme

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Chromium has no handler for w3bs://, so TronBrowser now routes W3BS URIs to https://w3bs.org/browse?q=<uri> (the existing resolver page) from every entry point:

  • Launcher: tron w3bs://prompt/w3bs/research@1 rewrites the arg to the gateway; TRONBROWSER_W3BS_GATEWAY overrides it.
  • Desktop entries (install.sh, build-release.sh, AppImage) claim x-scheme-handler/w3bs. install.sh sets TronBrowser as the default only when nothing else (e.g. the w3bs inspector) already handles it.
  • Bundled extension: w3bs-links.js turns clicks on w3bs: links into in-tab navigations, so there is no xdg-open dialog (middle/modifier click opens a new tab). Same match patterns as the existing content scripts, so no new permissions. The new-tab box treats a W3BS URI as an address.

Tested:

  • vitest run in apps/desktop: 157 passed, 4 skipped (new launcher + w3bs.test.js cases)
  • sh -n on the launcher and install.sh
  • live w3bs.org resolves the launcher's percent-encoded q (HTTP 200, canonical research@1.0.0)
  • Chromium 1243 with the extension loaded: clicking a w3bs:// link landed on w3bs.org/browse?q=w3bs%3A%2F%2Fprompt%2Fw3bs%2Fresearch%401

Typing w3bs://… in the omnibox still goes through Chromium's external-protocol prompt, then the desktop handler, then a new tab. Linux only; macOS/Windows scheme registration is not covered.

🤖 Generated with Claude Code

Chromium has no handler for w3bs://, so W3BS URIs now route to
https://w3bs.org/browse?q=<uri> from every entry point:

- launcher: `tron w3bs://...` args are rewritten to the gateway
  (TRONBROWSER_W3BS_GATEWAY overrides it)
- desktop entries claim x-scheme-handler/w3bs; install.sh makes
  TronBrowser the default only when no other handler is set
- bundled extension: w3bs-links.js turns clicks on w3bs: links into
  in-tab navigations (middle/modifier click opens a new tab), and the
  new-tab box treats a W3BS URI as an address in web and AI modes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

48 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 25 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:246
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:275
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:345
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:167
MEDIUM sh-remote-script-execution apps/web/public/install.sh:407
MEDIUM sh-remote-script-execution apps/web/public/install.sh:425
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:28
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:261
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32
LOW js-hardcoded-crypto-key services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 003fb51 into main Oct 20, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant