Any Protocol other than http not working - their content is sent to default search engine (Eg: ftp://ipaddr, blob:somebloburl, javascript:somecode This all goes to search engine

[tathastu871]

No description provided.

[bsclifton]

cc: @deeppandya @SergeyZhukovsky

[tathastu871]

cc: @deeppandya @SergeyZhukovsky

Even ftp sites and blob urls generated via javascript are going through engine

Try searching ftp://xxx.xxx.xx.x:443 it goes through google search

Any Explicitly defined protocol by user

regex of search query
^(ftp|http|ftps|https|javascript|blob):.*
Must not go through search engine

CURRENT WORKAROUND STORE IN BOOKMARKS THEN ACCESS

ALSO FTP SITES CANNOT BE OPENED WHY IT POPUP INTENT INTERCEPT AND FAILS

[deeppandya]

CC @fmarier what do you think of the issue in terms of security concerns ?

[fmarier]

I believe that javascript: is banned from direct navigations (with the exception of bookmarks) on purpose because it has caused lost of issues in the past. I imagine blob: URLs are blocked for similar reasons, but I also don't see how they could even make sense typed directly in the URL bar.

ftp is not supported by Chromium anymore and so it's not a recognized protocol and is expected to have the same behavior as trying to navigate to gopher://example.com (also not supported).

[tathastu871]

cors will already prevent malicious javascript urls being ran on location.href
atleast user needs to run bookmarklets,
Brave doesnt have devtools or extension where user can do web testing
bookmarklets are only option

[tathastu871]

#18671
Just give a thought

[tathastu871]

What the hell man cannot run bookmarklets cannot export bookmarks
sucks

[fmarier]

What the hell man cannot run bookmarklets

Works for me:

cannot export bookmarks

Open brave://bookmarks/ and then use the export option here:

[bsclifton]

Hi folks - I'm going to go ahead and close this issue. It's a bit all over the place as-is (are we asking for specific protocols to be allowed-listed?)

If there's a specific problem (something that can not be done), let's create a new issue for that specific problem. Capturing clearly what happens and what is expected. And we can go from there. Thanks!

[tathastu871]

Using window.open() to open javascript blob protocols be banned is good for security purposes
But at least not when user manually type