Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4707GitHub issuePublicReceived

[Security] omarchy-webapp-install writes javascript:/file: URLs into Chromium --app=

Reported by Chessing234 · filed Aug 27, 2026Closed upstream on 2026-08-29 by the merge of PR #8496 (closed by ryanrhughes). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

[Security] omarchy-webapp-install writes javascript:/file: URLs into Chromium --app=revision 1 · captured 2026-10-04 12:03 UTC via poll

omarchy-webapp-install prefixes a schemeless URL with https://, then writes it into the desktop Exec as omarchy-launch-webapp $APP_URL. Chromium --app= will still run javascript:, file:, and data: if those schemes are passed in.

if [[ ! $APP_URL =~ ^[a-zA-Z][a-zA-Z0-9+.-]*: ]]; then
  APP_URL="https://$APP_URL"
fi
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp $APP_URL}"

omarchy-webapp-install 'x' 'javascript:alert(1)' webapp produces a launcher whose Exec is omarchy-launch-webapp javascript:alert(1). Same for file:///etc/passwd and data:text/html,.... Interactive gum input and a direct CLI invocation both reach this.

Expected

Keep the schemeless https:// prefix, then refuse anything that is not http:// or https:// before writing the desktop file.

View raw text
`omarchy-webapp-install` prefixes a schemeless URL with `https://`, then writes it into the desktop `Exec` as `omarchy-launch-webapp $APP_URL`. Chromium `--app=` will still run `javascript:`, `file:`, and `data:` if those schemes are passed in.

```bash
if [[ ! $APP_URL =~ ^[a-zA-Z][a-zA-Z0-9+.-]*: ]]; then
  APP_URL="https://$APP_URL"
fi
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp $APP_URL}"
```

`omarchy-webapp-install 'x' 'javascript:alert(1)' webapp` produces a launcher whose Exec is `omarchy-launch-webapp javascript:alert(1)`. Same for `file:///etc/passwd` and `data:text/html,...`. Interactive `gum` input and a direct CLI invocation both reach this.

## Expected

Keep the schemeless `https://` prefix, then refuse anything that is not `http://` or `https://` before writing the desktop file.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.