"secondlife:///app/chat/..." viewer URIs nerfed in local chat (for Linden viewer, not others)

[canny]

Attempting to generate hypertext in local chat that, when clicked, would trigger the script to output more text to local chat. There's a viewer URI incantation that seems ideal for it: secondlife://app/chat//<trigger_text> where the script listens on and responds when it sees <trigger_text>. Unfortunately in the Linden viewer (and Catznip), this results in "[Second Life: A SLurl was received from an untrusted browser and has been blocked for your security.]" after which it won't try again until a relog.

https://secondlife.canny.io/admin/board/bug-reports/p/secondlife-app-chat-viewer-uris-nerfed-in-local-chat-for-linden-viewer-not-other

---

This repo is using Opire - what does it mean? 👇

💵 Everyone can add rewards for this issue commenting /reward 100 (replace 100 with the amount).
🕵️‍♂️ If someone starts working on this issue to earn the rewards, they can comment /try to let everyone know!
🙌 And when they open the PR, they can comment /claim #5012 either in the PR description or in a PR's comment.

🪙 Also, everyone can tip any user commenting /tip 20 @canny[bot] (replace 20 with the amount, and @canny[bot] with the user to tip).

📖 If you want to learn more, check out our documentation.

[canny]

This issue has been linked to a Canny post: "secondlife:///app/chat/..." viewer URIs nerfed in local chat (for Linden viewer, not others) 🎉

[Dan-Linden]

discussion here: https://lindenlab.slack.com/archives/C02R43FJP/p1763490768196539

[QieNiangao]

I stumbled on this decade-old report, that seems relevant and apparently still open: secondlife/jira-archive#1151 (which may already be linked in the slack discussion for all I know).

[akleshchev]

Needs use cases/examples for analysis.

If it's being used from hud, we should be able to permit it, may be with some one-time warnings. But if it's being used in random inworld objects, permiting it might become a 'spam' risk.

[QieNiangao]

I don't know that this should be constrained to my specific use case, but FWIW, my immediate application is indeed a HUD with one button that initiates a dialog box with the owner, from which selections start local chat hypertext interactions solely with that owner.

Note that this all works fine in Firestorm and Alchemy. And even in the Linden viewer, the very same /chat/ URI interaction works without warning nor error message as long as it's initiated with a right-mouse-button->"Run This Command" gesture. I learned this today in a Forums discussion, https://community.secondlife.com/forums/topic/528870-are-secondlifeappchat%E2%80%A6-viewer-uris-supposed-to-work-in-local-chat-further-befuddlement/ (which Canny refused to link in my initial report).

I'd just note that, although the "Run This Command" option is extremely unpalatable, even that would be preferable to exposing users to a warning message. Assuming that gesture is intended to be supported here, or that concern about the functionality is limited to potential "spam", it really really shouldn't message using "untrusted browser" or "blocked for your security" which is jet fuel for paranoia.

[akleshchev]

Checked the code over and it's intended to be clickable, just shouldn't be externally accessible, so enabled clicking it.

[akleshchev]

@kylelinden
Looks like this was implemented as 'untrusted' long before we added 'clicked' support. Enabling it for clicks looks relatively low risk as it seems to be intended for script interaction via clicking.