{{ message }}
Repository navigation
Link with custom protocoll does not work #4356
Description
Description
Link with custom protocoll does not work
Minimal Reprouducible Markdown Example (or Steps)
For example
- Create Link sambesi://localhost/node/11164
- Click on Link
Stack Trace
TypeError: Cannot read properties of null (reading 'length')
at Proxy.FORMAT_LINK_CLICK (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:86727:22)
at Proxy.wrappedAction (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:13893:19)
at Object.jumpClick (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:150691:19)
at LinkTools.selectItem (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:149183:22)
at Object.click (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:149160:18)
at invokeHandler (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:92215:13)
at handleEvent (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:92226:5)
at HTMLLIElement.handler (file:///C:/Users/inb/AppData/Local/Programs/MarkText/resources/app.asar/out/renderer/assets/index-DgUR2NkZ.js:92231:5)
Version
MarkText: v0.19.0
Operating system: Windows_NT x64 10.0.26200 (win32)
Activity
FurkaanBoraa commentedon Jun 12, 2026
Reproduced on macOS (Apple Silicon) against the latest
develop(64e590c), so this is not Windows-specific. Steps: open a document containing[sambesi://localhost/node/11164](sambesi://localhost/node/11164), hover the link, and click the jump button in the popover — the renderer throws the sameTypeError: Cannot read properties of null (reading 'length')inFORMAT_LINK_CLICK.Root cause: muya's
sanitizeHyperlink(DOMPurify's protocol allowlist) strips thesambesi://href at render time, so the link popover captureshref: null, and the jump handler forwards that toFORMAT_LINK_CLICK, which readdata.href.lengthwithout a guard.There are two separate things in this issue:
The crash — fixed in fix: #4356 crash when using the link popover on a link with an unsupported protocol #4473: the popover no longer offers "jump" when there is no usable href, and the store guards null defensively.
Custom protocols not opening at all — this appears deliberate and predates the engine rewrite: the main-process
mt::format-link-clickhandler only openshttp(s)URLs and explicitly swallows other schemes (// Prevent other URLs.inpackages/desktop/src/main/menu/actions/file.ts). Opening arbitrary schemes viashell.openExternalis a real security surface, so I left that behavior unchanged in the PR. If supporting custom protocols (perhaps behind a confirmation prompt or a preference) is wanted, I would be happy to work on it as a follow-up once there is maintainer guidance on the desired approach.FurkaanBoraa commentedon Jun 12, 2026
For maintainers triaging this: there are now two open PRs on this issue with different scopes. #4416 (earlier) proposes actually opening custom-protocol links via
shell.openExternalwith a denylist of unsafe schemes. My #4473 is narrower — it only fixes the crash (the popover stops offering "jump" when the sanitizer stripped the href, plus a null guard in the store) and deliberately leaves the existing http(s)-only policy unchanged, treating "should custom schemes open at all" as a maintainer decision. The two PRs conflict textually (both touchstore/editor.tsand addtest/e2e/issue-4356.spec.ts), so whichever direction is preferred, I'm happy to rebase or adapt mine.Jocs commentedon Jun 15, 2026
Many thanks to @FurkaanBoraa for investigating and fixing the issue. #4414 still seems to be in draft state. I will review it together once this PR is ready.
fix: marktext#4356 don't crash on links whose href was sanitized away
fix: marktext#4356 don't crash on links whose href was sanitized away
fix: #4356 don't crash on links whose href was sanitized away (#4473)
fix(desktop): publish only block kinds in the native selection menu s…