From 8dc24807c3e3eb473ac329a66ae704e5a6b4698d Mon Sep 17 00:00:00 2001 From: AwesomeTy18 <93415004+AwesomeTy18@users.noreply.github.com> Date: Tue, 13 Oct 2026 03:21:46 -0400 Subject: [PATCH 1/2] Add web browser entitlement check for URL scheme validation --- RootHelper/main.m | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/RootHelper/main.m b/RootHelper/main.m index d06d27a..136abdf 100644 --- a/RootHelper/main.m +++ b/RootHelper/main.m @@ -822,6 +822,9 @@ void applyPatchesToInfoDictionary(NSString* appPath) NSArray* CFBundleURLTypes = infoDictM[@"CFBundleURLTypes"]; if([CFBundleURLTypes isKindOfClass:[NSArray class]]) { + NSDictionary* entitlements = dumpEntitlementsFromBinaryAtPath(appMainExecutablePathForAppPath(appPath)); + BOOL isWebBrowser = [entitlements[@"com.apple.developer.web-browser"] isEqual:@YES]; + NSMutableArray* CFBundleURLTypesM = [NSMutableArray new]; for(NSDictionary* URLType in CFBundleURLTypes) @@ -841,7 +844,9 @@ void applyPatchesToInfoDictionary(NSString* appPath) continue; } - if([appleSchemes containsObject:existingURLScheme.lowercaseString]) + NSString* URLScheme = existingURLScheme.lowercaseString; + BOOL isWebURLScheme = [URLScheme isEqualToString:@"http"] || [URLScheme isEqualToString:@"https"]; + if((isWebURLScheme && !isWebBrowser) || (!isWebURLScheme && [appleSchemes containsObject:URLScheme])) { [URLSchemesSet removeObject:existingURLScheme]; } From 1e360fc42e9434f5c02e2d41dfc0b4e287c304aa Mon Sep 17 00:00:00 2001 From: AwesomeTy18 <93415004+AwesomeTy18@users.noreply.github.com> Date: Thu, 5 Nov 2026 01:00:10 -0500 Subject: [PATCH 2/2] Improve browser URL scheme validation --- RootHelper/main.m | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RootHelper/main.m b/RootHelper/main.m index 136abdf..21bb94b 100644 --- a/RootHelper/main.m +++ b/RootHelper/main.m @@ -846,7 +846,7 @@ void applyPatchesToInfoDictionary(NSString* appPath) NSString* URLScheme = existingURLScheme.lowercaseString; BOOL isWebURLScheme = [URLScheme isEqualToString:@"http"] || [URLScheme isEqualToString:@"https"]; - if((isWebURLScheme && !isWebBrowser) || (!isWebURLScheme && [appleSchemes containsObject:URLScheme])) + if([appleSchemes containsObject:URLScheme] && !(isWebBrowser && isWebURLScheme)) { [URLSchemesSet removeObject:existingURLScheme]; }