On Fri, 7 Aug 2026 03:10:48 GMT, Prasanta Sadhukhan <[email protected]> wrote:
> `JDK has the following API : java.awt.Desktop.browse(URI) "Launches the > default browser to display a URI." > > On Windows and macOS, the JDK used to call platform APIs to do this which > would recognise some schemes as ones which would launch an associated > application. For example on Windows "calculator:" is a scheme that windows > may open the calculator, and on macOS "facetime:" may open the facetime > application. > > Desktop.browse now always launches the browser directly, which is a problem > for apps that took advantage of the previous behavior, since the browser > itself may not re-direct to those applications. > > The current behaviour is intentional to provide a secure-by-default behaviour. > > The proposal here is to introduce an implementation system property ( > **awt.desktop.browse_insecure**) which will allow apps to opt back into the > old behaviour on Windows and macOS. > > The end-user, or the application, can set this property as a comma separated > list of allowed schemes : > > -Dawt.desktop.browse_insecure=calculator,file > > where on Windows, the calculator and file scheme will be opened in open > calc.exe and the File Explorer app respectively. > > or -Dawt.desktop.browse_insecure=* > > which allows all schemes. > > If -Dawt.desktop.browse_insecure is set or the scheme is in the allowed list, > then JDK will open the URI using platform APIs which may open an associated > app instead of the browser > If -Dawt.desktop.browse_insecure is NOT set or scheme is NOT in the allowed > list, the browser is explicitly launched and URI is handled by the browser - > i.e. no change from current behaviour. > > > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Just an overall feedback about this and that old changes: 1. I wonder that the usage of standard dispatcher API from the OS was considered legacy way to open the urls. And a direct usage of any registered app as browser is better(isBrowseInsecureAllowed!!!). 2. The current and the patched versions of the code are actually contradicts the spec of the Desktop.browse(), which was mirror the "Runtime.exec()" as a wrapper for OS dispatcher. > * Launches the default browser to display a {@code URI}. > * If the default browser is not able to handle the specified > * {@code URI}, the application registered for handling > * {@code URIs} of the specified type is invoked. The application > * is determined from the protocol and path of the {@code URI}, as > * defined by the {@code URI} class. The change feels like changing "Runtime.exec()" to always run the path in browser. ------------- PR Comment: https://git.openjdk.org/jdk/pull/32247#issuecomment-5223241587
