Skip to content

Browser allowlist is immutable

What changed

pkg/browser previously exported the scheme allowlist as a mutable package variable:

var AllowedSchemes = []string{"https", "http", "mailto"}

This contradicted the documented "not configurable" guarantee — any caller could widen (or empty) the allowlist at runtime and bypass the scheme gate. The variable has been unexported (allowedSchemes) and replaced with a function that returns a defensive copy:

// AllowedSchemes returns the URI schemes that OpenURL permits.
// The returned slice is a fresh copy on every call.
func AllowedSchemes() []string

Migration

If you read the allowlist for display or logging, call the function and drop the slice literal access:

// Before
schemes := browser.AllowedSchemes

// After
schemes := browser.AllowedSchemes()

If you previously mutated browser.AllowedSchemes to add a scheme, that path is intentionally removed. Extending the allowlist now requires a first-party code change with security-review sign-off, as the package documentation has always stated.