Safari Extension is starting to hijack all Google links again

kickdaddy

I found this older bug:
https://kagifeedback.org/d/2814-safari-extension-redirects-all-google-requests

It appears the new version of the extension has the same problem. I am using the Safari Extension (just downloaded the latest, but the previous version was doing it as well). I have my Search Engine set to DuckDuckGo (as we used to have to select an unused search engine). Whenever I click on a link within a Google site, they use the "www.google.com?url=XXX" redirect before it opens the site - Kagi hijacks that and turns it into a search result on Kagi.com.

For example, if I am on Google Calendar, and I click on a link in an invite, it will do the above. I have to copy and paste the URL into the address bar to be able to get to the link. I tried "Denying" the Kagi extension on the Google Calendar and Gmail websites, but that didn't fix it.

If I am using a Google property like Google Calendar, and I click on a link, it should not do the Kagi redirection, it should load the URL in the browser. My assumption is that this is only a problem on Google properties since they use the "www.google.com?url=" redirect for all links. That uses the domain calendar.google.com. So one possible solution to this is just don't rewrite URLs to Kagi if the click came from a "*.google.com" domain.

Vlad

kickdaddy The new version should have a setting for what the search engine set in Safari is. If this is set to DDG then the extension should not redirect any Google links. We will check.

Kearch

kickdaddy don’t have a solution unfortunately but you guys should check out the XSearch Safari web extension. You can set it to use Kagi as default (override Global Safari search engine) and this works 100% of the time there’s also other feature baked in. Just a suggestion until the bugs with the kagi app get sorted.

nanoscrew

@kickdaddy you're right about the cause, looks like any "google.com" url that has a "q=<something>" parameter will be redirected to Kagi, even if it's not on Google Search.

leokennis

What I did that fixed the issue:

From Settings.app deny the Kagi extension all access
Go to the search engine you’ve set in Safari settings that you want redirected to Kagi (or, just do a search in Safari)
From the search results page, open the Kagi extension and allow it access to this site
Safari will ask if you want to allow access for 1 day or forever, click forever but then do not click “forever for all sites” but only “forever on DuckDuckGo” (or whatever search engine you have set)

seajay1221

leokennis this works, thank you. I’m shocked you can’t revoke individual domains natively from within the extension easily, but this workaround - for the people who invest the time to find out about it - helps.

nanoscrew

@kickdaddy @leokennis a new macOS extension (2.2.1) is now available on the App Store, and it prevents google url hijacking for non-search urls. It's only redirecting to Kagi if you navigate to a google url where the path starts with /search.

nanoscrew

seajay1221 I was shocked too when I realized it was impossible in Safari extensions without granting significantly more permissions to the extension 🫤 . There's a straightforward API for this, but Safari fails silently when calling it for certain scenarios (such as trying to remove the "Allow All Websites" permission from within the extension itself).

kickdaddy

Fixed - thanks all!

Vlad

Fixed in 2.2.1!