{"id":28712470,"url":"https://github.com/flatpak/xdg-native-messaging-proxy","last_synced_at":"2026-03-07T00:02:02.342Z","repository":{"id":280536832,"uuid":"939627769","full_name":"flatpak/xdg-native-messaging-proxy","owner":"flatpak","description":null,"archived":false,"fork":false,"pushed_at":"2025-08-12T11:14:39.000Z","size":40,"stargazers_count":32,"open_issues_count":1,"forks_count":1,"subscribers_count":10,"default_branch":"main","last_synced_at":"2026-01-22T16:37:28.238Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-2.1","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/flatpak.png","metadata":{"files":{"readme":"README.md","changelog":"NEWS.md","contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-02-26T21:02:40.000Z","updated_at":"2026-01-08T07:41:54.000Z","dependencies_parsed_at":"2025-03-04T01:24:35.050Z","dependency_job_id":"301d37b0-8b50-46bb-aba1-f81bbd930ccf","html_url":"https://github.com/flatpak/xdg-native-messaging-proxy","commit_stats":null,"previous_names":["swick/xdg-native-messaging-proxy","flatpak/xdg-native-messaging-proxy"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/flatpak/xdg-native-messaging-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flatpak%2Fxdg-native-messaging-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flatpak%2Fxdg-native-messaging-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flatpak%2Fxdg-native-messaging-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flatpak%2Fxdg-native-messaging-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/flatpak","download_url":"https://codeload.github.com/flatpak/xdg-native-messaging-proxy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flatpak%2Fxdg-native-messaging-proxy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30204109,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T19:07:06.838Z","status":"ssl_error","status_checked_at":"2026-03-06T18:57:34.882Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-14T23:06:11.764Z","updated_at":"2026-03-07T00:02:02.324Z","avatar_url":"https://github.com/flatpak.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xdg-native-messaging-proxy\n\nThis is a small service which can be used to find native messaging host\nmanifests, as well as start and stop those native messaging hosts.\n\nApplications running inside a sandbox might have a limited view of the host\nwhich might prevent them from finding and executing native messaging hosts\nwhich exist outside of the sandbox. This proxy is supposed to run outside of any\nsandbox, which will make the native messaging hosts outside the sandbox\navailable to anyone with access to the dbus service.\n\nIt is critical to understand that exposing this proxy, or any other scheme which\nmakes the native messaging hosts from outside a sandbox available to a sandboxed\nprocess, is potentially *INSECURE*!\n\nNative messaging is a form of IPC but the specifics of which services get\nexposed over this IPC mechanism are unknown. Any of the services could provide\nsome functionality that allows the caller to escape the sandbox. An obvious\nexample is the native messaging host for installing GNOME Shell extensions,\nwhich allows sandboxed callers to run arbitrary code outside of the sandbox. A\nmore subtle example are native messaging hosts which allow writing files to\narbitrary locations, which can be used to, for example, add code to .bashrc or\nchange the permissions of a sandboxed flatpak application.\n\nAdditionally, users will not be able to judge if a native messaging host API\nprovides the tools to escape the sandbox, making it impossible to offload this\nproblem to the users.\n\nPreviously, the functionality that xdg-native-messaging-proxy provides was\nimplemented in a merge request for xdg-desktop-portal and was shipped by Ubuntu\nfor a number of releases. However, xdg-desktop-portal APIs are supposed to be\ngenerically useful and secure for sandboxed applications which is not the case\nfor any native messaging proxy. By moving the functionality to its own dbus\nname, we do not need to provide a secure API and applications which want to make\nuse of the proxy have to explicitly request talk permission to this dbus name in\ntheir manifest.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflatpak%2Fxdg-native-messaging-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflatpak%2Fxdg-native-messaging-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflatpak%2Fxdg-native-messaging-proxy/lists"}