Ah yes I forgot about the app signature. If I understand your screenshot correctly, it looks like the later versions of SourceTree automatically checks the signature on launch? I guess my version of SourceTree is too old to even have that lol. I can manually verify that the signature validation fails though:

$ codesign -dv --verbose=4 /Applications/SourceTree.app/
/Applications/SourceTree.app/: invalid signature (code or signature have been modified)

Unfortunately I can't update SourceTree on my OSX version and I think I'd rather live with an incorrect signature than a potential drive-by exploit.

BTW, this is kind of off-topic but how do you @ mention correctly? Doesn't seem to work

yat.so Doing that invalidates the code signature of the app, compromising security technically.

@Brian Ganninger Have you tried it also with the Info.plist modification as mentioned in step 1? I just re-tested this... it looks like if I modify the Info.plist to comment out the CFBundleURLTypes entry and I re-register SourceTree with LaunchServices using the following command, the URL scheme still doesn't trigger SourceTree:

/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -v /Applications/SourceTree.app/

I also tried uncommenting the entry in Info.plist and un-registering then re-registering it and the URL Scheme once again triggers SourceTree. This seems to imply the URL scheme is permanently disabled by editing the Info.plist along with unregistering SourceTree unless I'm missing something?

Hi cmc, 

Unfortunately, not at the moment. We support two versions of macOS and do not support older versions of SourceTree. As a best practice, we recommend updating to the most current version to get new features, bug fixes, and security patches. Thank you for reaching out.

Best, 

Rahul 

Product Manager | SourceTree

Any chance we'll see a release of SourceTree that fixes this bug for OS releases prior to 10.11?

murat619405784 That's just a bogus URL, not an actual exploit. If it was ST would alert you.

After upgrading to 2.5.1, the 'open sourcetree://test' command from terminal still makes SourceTree gain focus. Does this mean that the vulnerability isn't fixed, or is it still fixed by 2.5.1 in some other way?

Thanks

yat.so In my testing (10.11.6) this unregisters the application as a handler only until the next time it's launched; in addition it exhausts all handlers it can find on the system [that took me a bit to ferret out.] For active users this workaround won't suffice.

No problem 

Thanks for the workaround!