Rosyna Keller on Twitter: "@mjtsai That is, Sparkle was *explicitly* opening every file using LaunchServices by overriding the default WebView handler."

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Rosyna Keller ‏@rosyna Feb 2

@mjtsai As most apps using sparkle don't Quarantine files they create, Gatekeeper is never invoked in the first place.
Michael Tsai ‏@mjtsai Feb 2

@rosyna Did anyone imply otherwise?
Rosyna Keller ‏@rosyna Feb 2

@mjtsai I inferred it from "This seems like more of a WebKit vulnerability"
Michael Tsai ‏@mjtsai Feb 2

@rosyna What I meant by that is, why is WebKit executing any non-JavaScript code?
Rosyna Keller ‏@rosyna Feb 2

@mjtsai It's passing it to LaunchServices (as WebKit does for other protocol handlers). Quarantine normally prevents execution.
Michael Tsai ‏@mjtsai Feb 2

@rosyna I get that, but I don’t understand why I would want my browser to be able to do that silently, especially via JavaScript.
1 like
Rosyna Keller ‏@rosyna Feb 2

@mjtsai You wouldn't want your browser to. But you do want WebKit to be able to do so. It's used in app documentation.
1 like
Rosyna Keller ‏@rosyna Feb 2

@mjtsai Well, you'd want WebView to do it.
Rosyna Keller ‏@rosyna Feb 2

@mjtsai And WebViews have a method to change this behavior https://developer.apple.com/library/mac/documentation/Cocoa/Reference/WebKit/Protocols/WebPolicyDelegate_Protocol/#//apple_ref/occ/instm/NSObject/webView:decidePolicyForNavigationAction:request:frame:decisionListener …: that Sparkle overrode (https://github.com/sparkle-project/Sparkle/commit/70f6929ac766b404e8e0d28d5cbda7872dc2ee3f …)
1 like
Rosyna Keller ‏@rosyna Feb 2

@mjtsai Err, that was supposed to link to -webView:decidePolicyForNavigationAction:request:frame:decisionListener:

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

Rosyna Keller

@rosyna

Loading seems to be taking a while.

false

Saved searches

Rosyna Keller

@rosyna

Go to a person's profile

Saved searches

Retweet this to your followers?

Saved searches

Are you sure you want to delete this Tweet?

Promote this Tweet

Block

Add a location to your Tweets

Profile summary

Your lists

Create a new list

Copy link to Tweet

Embed this Tweet

Embed this Video

Preview

Log in to Twitter

Sign up for Twitter

Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

Two-way (sending and receiving) short codes:

Confirmation

Buy Now

Hmm... Something went wrong. Please try again.

Welcome home!

Tweets not working for you?

Say a lot with a little

Spread the word

Join the conversation

Learn the latest

Get more of what you love

Find what's happening

Never miss a Moment

Loading seems to be taking a while.

Promoted Tweet

false