starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Cannot use URL for config icon #23388

New Issue
Closed
opened 2026-01-31 08:40:46 +00:00 by claunia · 7 comments
claunia commented 2026-01-31 08:40:46 +00:00
Owner
Copy Link

Originally created by @jachaussloef on GitHub (Jun 27, 2025).

Windows Terminal version

1.22.11751.0

Windows build number

10.0.26100.4351

Other Software

No response

Steps to reproduce

In settings when you insert a url icon (such as OpenSUSE's https://static.opensuse.org/favicon.ico), after inserting the icon displays normally. When hitting SAVE it reported it was invalid.

Image

Expected Behavior

No response

Actual Behavior

After updating to 1.22.11751.0, URL icon cannot be used as config icon. When first launching after updating it reported that it finds an "invalid" config icon and changed it back to default (which means it was valid before).
Image

Originally created by @jachaussloef on GitHub (Jun 27, 2025). ### Windows Terminal version 1.22.11751.0 ### Windows build number 10.0.26100.4351 ### Other Software _No response_ ### Steps to reproduce In settings when you insert a url icon (such as OpenSUSE's https://static.opensuse.org/favicon.ico), after inserting the icon displays normally. When hitting SAVE it reported it was invalid. ![Image](https://github.com/user-attachments/assets/bf555378-77e1-455f-80cc-fa97ed1f798b) ### Expected Behavior _No response_ ### Actual Behavior After updating to 1.22.11751.0, URL icon cannot be used as config icon. When first launching after updating it reported that it finds an "invalid" config icon and changed it back to default (which means it was valid before). ![Image](https://github.com/user-attachments/assets/5453adee-6d0c-4234-a65d-0761396a0eab)
claunia added the Area-SettingsIssue-BugNeeds-Tag-FixProduct-TerminalPriority-1 labels 2026-01-31 08:40:46 +00:00
claunia commented 2026-01-31 08:40:48 +00:00
Author
Owner
Copy Link

@Roger-WIN commented on GitHub (Jun 27, 2025):

If you have viewed the changelog, you will know that this change was intentional, even though I don't like it either.

Image

@Roger-WIN commented on GitHub (Jun 27, 2025): If you have viewed the changelog, you will know that this change was intentional, even though I don't like it either. ![Image](https://github.com/user-attachments/assets/9beb95e7-7c9d-4482-bdbb-9385d745f854)
claunia commented 2026-01-31 08:40:48 +00:00
Author
Owner
Copy Link

@Frulfump commented on GitHub (Jun 28, 2025):

If you have viewed the changelog, you will know that this change was intentional, even though I don't like it either.

Oh it was unclear that HTTPS was also not allowed from the release note which I read but now I read the PR and it's clear from that.
cc @DHowett

https://github.com/microsoft/terminal/pull/19044

This pull request adds a filesystem path validator (which accepts images with fully-qualified paths and UNC paths), makes the URI validator reject any web-origin URIs (only file and ms-* are allowable), and suppresses warnings for any images that were not directly set by the user.

I added a feature request to get icons for popular distros here https://github.com/microsoft/terminal/issues/19078

@Frulfump commented on GitHub (Jun 28, 2025): > If you have viewed the changelog, you will know that this change was intentional, even though I don't like it either. Oh it was unclear that HTTPS was also not allowed from the release note which I read but now I read the PR and it's clear from that. cc @DHowett https://github.com/microsoft/terminal/pull/19044 >This pull request adds a filesystem path validator (which accepts images with fully-qualified paths and UNC paths), makes the URI validator reject any web-origin URIs (only file and ms-* are allowable), and suppresses warnings for any images that were not directly set by the user. I added a feature request to get icons for popular distros here https://github.com/microsoft/terminal/issues/19078
claunia commented 2026-01-31 08:40:48 +00:00
Author
Owner
Copy Link

@ipcjs commented on GitHub (Jun 29, 2025):

What are the security risks of using URL icons? I don't get it.🙁

@ipcjs commented on GitHub (Jun 29, 2025): What are the security risks of using URL icons? I don't get it.🙁
claunia commented 2026-01-31 08:40:48 +00:00
Author
Owner
Copy Link

@jachaussloef commented on GitHub (Jun 29, 2025):

Sounds great. Intentionally introducing a bug. (Yes I'll still call it a bug until it's fixed, if not I'll call it a bug forever)

@jachaussloef commented on GitHub (Jun 29, 2025): Sounds great. Intentionally introducing a bug. (Yes I'll still call it a bug until it's fixed, if not I'll call it a bug forever)
claunia commented 2026-01-31 08:40:49 +00:00
Author
Owner
Copy Link

@ayakasuki commented on GitHub (Jul 5, 2025):

晕 我以为是我的问题 更新1.22最新这个v1.22.11751.0以后 就不能用url加载随机背景图和icon了 真的是败笔 本地文件并不支持随机图 就不好用 原来是故意的

@ayakasuki commented on GitHub (Jul 5, 2025): 晕 我以为是我的问题 更新1.22最新这个v1.22.11751.0以后 就不能用url加载随机背景图和icon了 真的是败笔 本地文件并不支持随机图 就不好用 原来是故意的
claunia commented 2026-01-31 08:40:49 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Jul 16, 2025):

Three-pronged plan:

  1. FWIW, we consider web-source icons a security risk because they allow a distribution author, or other fragment profile author, to silently insert a tracking pixel with which they can measure usage server-side and with the concomitant risk of exposed PII ↩︎

  2. I'm the one who jumped the gun here, sorry. ↩︎

@DHowett commented on GitHub (Jul 16, 2025): Three-pronged plan: - Revert disallowing web-source icons[^1] from #19044 - Fix support for `ms-resource` and `ms-appx` icons referring to packages _outside_ Terminal - Do a real deprecation plan[^2] [^1]: FWIW, we consider web-source icons a security risk because they allow a distribution author, or other fragment profile author, to _silently insert a tracking pixel_ with which they can measure usage server-side and with the concomitant risk of exposed PII [^2]: I'm the one who jumped the gun here, sorry.
claunia commented 2026-01-31 08:40:49 +00:00
Author
Owner
Copy Link

@jachaussloef commented on GitHub (Jul 17, 2025):

What are the security risks of using URL icons? I don't get it.🙁

Honestly I know there can be risks, but instead of showing a warning and let users use at their own risk (maybe with a tick for never show this warning for this config again), it's done in a "brutal" way

@jachaussloef commented on GitHub (Jul 17, 2025): > What are the security risks of using URL icons? I don't get it.🙁 Honestly I know there can be risks, but instead of showing a warning and let users use at their own risk (maybe with a tick for never show this warning for this config again), it's done in a "brutal" way
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-Settings Issue-Bug Needs-Tag-Fix Priority-1 Product-Terminal
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#23388
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?