[shell] v2: no way to turn off the injected link handler, which blocks opener on _blank links

Open
  • Is something wrong?
#3,753 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

  • #3755 by @Sealdot — closed without merging

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript, rust, tauri
Domain
desktop, frontend

Research direction

Start by reading init-iife.js and the shell plugin's Builder, comparing its link handling with opener's Builder::open_js_links_on_click. The issue describes two possible fixes but does not choose between them, so clarify the intended behavior before making a change. Done means shell no longer blocks links handled by opener or by an app's own click handler.

Written by the indexing model from the issue text.

Description

plugin: shell
Describe the bug

On v2, tauri-plugin-shell always injects init-iife.js, which listens for clicks on <body> and sends every external <a target="_blank"> link to plugin:shell|open. There is no way to turn it off, unlike opener's Builder::open_js_links_on_click.

An app that registers both plugins and grants only opener:*, as the docs now recommend for opening links, gets dead links:

  • shell's listener runs first, calls preventDefault() and invokes shell.open, which rejects with shell.open not allowed;
  • opener's listener on window then returns early, because the click was already prevented.

shell's script also ignores defaultPrevented, so a link that handles its own click (for example to ask before opening) still gets sent to shell.open.

#3744 removes the script on v3, where open is gone, and describes the same interaction. On v2 the command still exists, so the script stays, but apps that only use shell for Command have no way to opt out.

Reproduction
  1. Register tauri_plugin_shell::init() and tauri_plugin_opener::init().
  2. Grant opener:default and shell:allow-spawn, but not shell:allow-open.
  3. Click <a href="https://tauri.app" target="_blank">.

Nothing opens, and the console shows shell.open not allowed.

Expected behavior

One of:

  • a shell Builder option to skip the link script, matching opener's open_js_links_on_click;
  • or, at least, the script returns early when event.defaultPrevented is set, as opener's does.

Today we work around it with a capture-phase listener that stops the click on the link before it reaches <body>.

Platform and versions

tauri 2, tauri-plugin-shell 2.4.0, tauri-plugin-opener 2.7.0, macOS. The script is unchanged on the v2 branch.

Dominant language
Rust
Stars
1.8k
Forks
637
Avg merge
5d 3h
Merged PRs (30d)
36

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tauri-apps/plugins-workspace

All issues in tauri-apps/plugins-workspace

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.