What, if any, URL protocols should I whitelist or blacklist when spawning the user's browser?

Question

I'm writing an app using Electron but I'd assume this would be a problem for any software that lets you open links in the user's default browser through the OS.

Let's say I have app that reads something like a twitter feed and displays it. So the app displays 10 entries. Some of those entries have user supplied links. If the user clicks a link I want to launch it in the user's default browser.

In Electron I'm told I should call electron.shell.openExternal(url). Do I need to be filtering URLs? Common URLs are for example http://xxx, https://xxx, mailto:xxx so I could just whitelist those 3 types of URLs. At the same time I don't want to wrongly limit good functionality. In other words I have no idea what other valid schemas there are. Allow ftp://? sftp://? gopher://? So I'd prefer to just pass everything through.

At the same time I'm worried, are there are potentially bad URLs? Hypothetical example: 3rdpartyAppWithScriptingHandler://evil.script

Should I whitelist? Blacklist? Filter? If so what's the filter? Or should I just pass them to OS?

Answer 1

Should I whitelist? Blacklist? Filter? If so what's the filter? Or should I just pass them to OS?

You should whitelist. I would go for a sensible minimum of http:, https:, mailto: and optionally ftp:. Including more protocols is unnecessary if you don't have a special use case in mind. That said some systems are more permissive than others. The Wordpress docs define this list of safe protocols in their wp_allowed_protocols() function:

Array of allowed protocols. Defaults to an array containing 'http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet', 'mms', 'rtsp', 'svn', 'tel', 'fax', 'xmpp', and 'webcal'.

None of these are inherently unsafe but you will not have any use case for a fax: or gopher: URL.

At the same time I'm worried, are there are potentially bad URLs?

There are pseudo-protocols that have side effects. javascript: URLs should definitely not be possible. The file: scheme is dangerous as well because local files are often more privileged than web content. For Firefox you especially don't want to allow chrome: and resource: URIs.

This is a good example for a problem where only whitelisting works since it's not possible to keep track of all the custom URI schemes and their effects for every single browser.