New CompApp url type (cai:///)

Niklas Heidloff is being very productive today on the CompApp wiki. He just uploaded another page called Pass Context to Components when opening Composite Applications. On this page he explains a new url type (cai:///):

“Opening a connection to a CAI URL will cause the corresponding application to be projected to the client or updated if already on the client, and then opened in the user interface to the specified page. If no page is specified, the first page in the application is opened.”

Besides being, as Nathan describes it, “hideous”, it’s never going to work IMHO. This approach fails the number one test for URL’s – they should be easily computable and/or written by users. How something with an appInstanceID of 63 characters (example: CFB7535080ECD4C270FDD126C5DD9E27_11_5JMPDRH1000980269G784H2GO4) came through QA I don’t know.

The page refers to M5 (probably milestone 5 for 8.5) and says that “we might publish [the url type] in Lotus Notes 8.0.1”. Let’s hope not!

4 thoughts on “New CompApp url type (cai:///)”

  1. Hi Mikkel,

    as long as the appInstanceID is computable, there can be some uses like for the notes: URL with replica ID and UNID – but only for developers, not for end users.

    Thomas

    Like

  2. Would this be coming via Expeditor? If so, you’d hope IBM have addressed this risk:

    A vulnerability in IBM Lotus Expeditor has been identified, which could be exploited to compromise a user’s system. The issue is that the application registers the “cai” URI handler, which allows launching rcplauncher.exe with arbitrary command line arguments. This can be exploited to execute arbitrary by having a user click on a malicous url link.

    Mentioned here http://stateofsecurity.com/?p=349

    Sounds like it hasn’t been fully thought through to me.

    Like

  3. Do you know if appInstanceID change?

    I’ve used it a day to call my CA from an XPage and it works, the day after appInstanceID was changed!!

    Thanks

    Andrea

    Like

Comments are closed.