[txmt-dev] TM2 enhanced txmt:// url scheme ideas

Hans-Jörg Bibiko bibiko at eva.mpg.de
Wed Sep 5 08:37:20 UTC 2012 

Hi,

I've just looked into the TM2 code and I've come across with an idea/suggestion/topic for discussion:

TM2 ships with the chance to open a file via txmt://open?url=foo which also is supported by AppleScript via “tell app "TextMate" to get url "txmt://open?url=foo"”.

This url request is sent to AppController Documents.mm :: handleTxMtURL .

How about to enhance this url scheme to support other "hosts" like "open"?

For instance:

- txmt://insertText?url=foo&text=bla&line4&column=6
-- to insert pure text into the file url or current doc
-- url, line, column are not obligatory
-- or one could also pass "range=start:length" for replacing 

- txmt://insertSnippet?url=foo&text=bla&line4&column=6
-- to insert pure text into the file url or current doc
-- url, line, column are not obligatory
-- or one could also pass "range=start:length" for replacing 

- txmt://setSelectedRange?url=foo&at=x&length=y
-- to the selection of the file url or current doc to {x, y}
-- url, line, column are not obligatory

- txmt://setSelectAll?url=foo
-- to the selection all of the file url or current doc to {x, y}
-- url, is not obligatory

- txmt://performBundleItem?uuid=foo
-- perform bundle item identified by its uuid foo on the current doc

- txmt://doCommandBySelector?url=foo&selector=bla
-- to try to do the selector bla in the file url or current doc
-- url is not obligatory
-- e.g. txmt://doCommandBySelector?selector=scrollToBeginningOfDocument
-- it could be a controlled set of possible selectors


... and many more like set grammar, set spelling language, add bookmark, ...
[ for more ideas see http://www.eva.mpg.de/~bibiko/downloads/textmate/tmtoolshelp.html ;) ]

I've just coded an example to support "insertText" and it works brilliant.

By supporting this kind of an API one is able to remote TM2 via bash (open ...) including any scripting languages, via AppleScript (which is already done by "get url"), and via HTML links and TM's JavaScript bridge "system" from the HTML output window

=== BUT !!!! === STOP, via HTML links and JavaScript?

This is potentially dangerous!! This would mean that someone (evil web programmer) could attack a running TM2 session!

To prevent these kinds of attacks and make the url scheme (not for "open", I think) much more safer it should be easily possible to sign such a txmt:// URL by using an internal TM session ID which is accessible via a TM_ shell variable.
This session ID will be generated if TM2 starts, any command invoked from TM2 knows that ID and passes it through the txmt:/ url back to TM2; and the method "handleTxMtURL" simply checks the internal against the passed one.


E.g. there's the TM_PID shell variable.
Then one could write a bundle commands which outputs the result as HTML output window like this:

cat <<HTML
<html>
<body>
<a href="txmt://insertText?text=foo&line=3&id=TM_PID">click me</a>
</body>
</html>
HTML

On runtime TM_PID will be evaluated and passed back to TM2 for authentication.


This approach minimizes the coding effort and opens a wide range of possibilities to remote TM2.

Any thoughts or comments?

[ and by the way, I'd start to implement this ;) based on your/Allan's restrictions and guidelines ]


Kind regards,
--Hans

More information about the textmate-dev mailing list