Zotero.launchURL() throws NS_ERROR_ILLEGAL_VALUE for non-HTTP schemes (regression in 10.0.2)

adfwfww
AI DISCLOSURE: the diagnosis and the suggested fix were produced with an AI assistant. I ran
the reproduction, the Debug ID, and the fix test below myself.

ENVIRONMENT
Zotero 10.0.2 (BuildID 20260909184950), Linux/Fedora 44, official tarball, clean profile,
no plugins. 10.0.1 works on the same machine.

SYMPTOM
Opening a custom scheme through Zotero.launchURL() does nothing - no prompt, no error. Fails
both from a plugin (obsidian://) and from the UI (double-clicking an "Attach Link to URI"
attachment with obsidian://open). `xdg-open "obsidian://open"` works.

REPRO (Tools > Developer > Run JavaScript)
var r; try { Zotero.launchURL('obsidian://open'); r = 'ok'; } catch (e) { r = 'ERR: ' + e; }
Zotero.debug('REPRO-RESULT ' + r); r

RESULT
ERR: [Exception... "Component returned failure code: 0x80070057
(NS_ERROR_ILLEGAL_VALUE) [nsIExternalProtocolService.loadURI]" nsresult:
"0x80070057 (NS_ERROR_ILLEGAL_VALUE)" location: "JS frame ::
chrome://zotero/content/xpcom/zotero.js :: this.launchURL :: line 1260" data: no]

DEBUG ID
D2073026704 - the same error appears three times in that log: once from the snippet
(REPRO-RESULT), twice from the UI (double-click and context-menu open, both at zotero.js:1260).

CAUSE
In chrome/content/zotero/xpcom/zotero.js, launchURL() passes no triggering principal
(line 1260), while launchFile() in the same file already passes one (lines 1191-1194). The
launchURL() call is at line 1237 in 10.0.1 and works there; 10.0.2's only platform change is
Gecko 140.13.0esr -> 140.15.0esr, so the platform update is what I assume changed the
behaviour. (I did not track down the Gecko change itself.)

TESTED PATCH
- svc.loadURI(Services.io.newURI(url, null, null));
+ svc.loadURI(Services.io.newURI(url, null, null), Services.scriptSecurityManager.getSystemPrincipal());

Applied to a copy of 10.0.2 and re-ran the snippet: it returns "ok" and the URI is handed to
the OS, i.e. the same call behaves as it does on 10.0.1. The path is scheme-agnostic, so any
non-http(s) scheme opened via Zotero.launchURL() looks affected.
Sign In or Register to comment.