"secondlife:///app/chat/..." viewer URIs nerfed in local chat (for Linden viewer, not others)

[canny]

Attempting to generate hypertext in local chat that, when clicked, would trigger the script to output more text to local chat. There's a viewer URI incantation that seems ideal for it: secondlife://app/chat//<trigger_text> where the script listens on and responds when it sees <trigger_text>. Unfortunately in the Linden viewer (and Catznip), this results in "[Second Life: A SLurl was received from an untrusted browser and has been blocked for your security.]" after which it won't try again until a relog.

https://secondlife.canny.io/admin/board/bug-reports/p/secondlife-app-chat-viewer-uris-nerfed-in-local-chat-for-linden-viewer-not-other

---

Test Plan

Setup:

1. Add the following script to an object.

default
{
    state_entry()
    {
        llListen(1,"",NULL_KEY,"");
    }
    listen(integer channel, string name, key id, string message)
    {
        llSay(0, "channel" + (string)channel + " got chat: "+llList2CSV([channel,name,id,message]));
    }
}

Test for non-zero channels:

1. Chat the following line in local chat
   secondlife://app//chat/1/testing
2. Click that link in chat.
3. Verify the scripted object reports that it got the chat.
   e.g. channel1 got chat: 1, testerd1 Tester, 3e2d81a3-6263-6ffe-ad5c-8ce04bee07e9, test

Test for zero channel (local chat);

1. Chat the following line in local chat
   secondlife://app//chat/0/testing
2. Click that link in chat.
3. Verify that "testing" is not chatted in local chat.
4. Verify you see a message "The SLurl you clicked on is not supported." as a notification and in the chat history.
5. Right-click the "secondlife://app//chat/0/testing" link and choose Run This Command.
6. Verify you see a message "The SLurl you clicked on is not supported." as a notification and in the chat history.

This repo is using Opire - what does it mean? 👇

💵 Everyone can add rewards for this issue commenting /reward 100 (replace 100 with the amount).
🕵️‍♂️ If someone starts working on this issue to earn the rewards, they can comment /try to let everyone know!
🙌 And when they open the PR, they can comment /claim #5012 either in the PR description or in a PR's comment.

🪙 Also, everyone can tip any user commenting /tip 20 @canny[bot] (replace 20 with the amount, and @canny[bot] with the user to tip).

📖 If you want to learn more, check out our documentation.

[canny]

This issue has been linked to a Canny post: "secondlife:///app/chat/..." viewer URIs nerfed in local chat (for Linden viewer, not others) 🎉

[Dan-Linden]

discussion here: https://lindenlab.slack.com/archives/C02R43FJP/p1763490768196539

[QieNiangao]

I stumbled on this decade-old report, that seems relevant and apparently still open: secondlife/jira-archive#1151 (which may already be linked in the slack discussion for all I know).

[akleshchev]

Needs use cases/examples for analysis.

If it's being used from hud, we should be able to permit it, may be with some one-time warnings. But if it's being used in random inworld objects, permiting it might become a 'spam' risk.

[QieNiangao]

I don't know that this should be constrained to my specific use case, but FWIW, my immediate application is indeed a HUD with one button that initiates a dialog box with the owner, from which selections start local chat hypertext interactions solely with that owner.

Note that this all works fine in Firestorm and Alchemy. And even in the Linden viewer, the very same /chat/ URI interaction works without warning nor error message as long as it's initiated with a right-mouse-button->"Run This Command" gesture. I learned this today in a Forums discussion, https://community.secondlife.com/forums/topic/528870-are-secondlifeappchat%E2%80%A6-viewer-uris-supposed-to-work-in-local-chat-further-befuddlement/ (which Canny refused to link in my initial report).

I'd just note that, although the "Run This Command" option is extremely unpalatable, even that would be preferable to exposing users to a warning message. Assuming that gesture is intended to be supported here, or that concern about the functionality is limited to potential "spam", it really really shouldn't message using "untrusted browser" or "blocked for your security" which is jet fuel for paranoia.

[akleshchev]

Checked the code over and it's intended to be clickable, just shouldn't be externally accessible, so enabled clicking it.

[akleshchev]

@kylelinden @Geenz
Looks like this was implemented as 'untrusted' from the start, before we added 'clicked' support. Enabling it for clicks looks relatively low risk as it seems to be intended for script interaction via clicking.

Functionality is specifically User->Script as it does not permit channel 0. Chat Channel

[kylelinden]

Asking Soft for a security review. However, this function never communicates to channel 0 (nearby chat) so is not at risk of abuse in the traditional 'phishing' sense.

[mcgroarty]

Reasonable and safe as long as QA explicitly confirms it doesn't allow chat to channel 0