py-appscript manual | 14. Notes

#

## 14. Notes

### Security issues

#### System Integrity Protection

In macOS 10.14+, System Integrity Protection helps to protect users from malicious AppleScripts by blocking (most) Apple events until and unless the user explicitly grants permission for one application to control another:

Be aware that these permissions apply at the GUI application level, not to specific `python` (or `osascript`) scripts or processes, so once granted for one script will apply to all scripts subsequently run by the same application. Standard commands (Apple events) recognized by all Mac applications (`run`, `open`, `quit`, etc.) are not affected.

The Automation controls in the Security & Privacy panel's Privacy tab in System Preferences may be used to alter an application's existing Automation (Apple event) permissions at any time:

To delete all existing Automation permissions in Terminal:

    tccutil reset AppleEvents

(See also: AppleScript-related changes in macOS 10.14.)

#### GUI Scripting

Non-scriptable applications with macOS Accessibility support may be controlled from Python by using the System Events application to manipulate their graphical interfaces directly. In macOS 10.9 and later, the user will be prompted to allow/deny the current application access to Accessibility features upon first use.

The Accessibility controls in the Security & Privacy panel's Privacy tab in System Preferences may be used to add or remove an application's Accessibility permissions at any time:

Older Mac OS versions had less granular security model, allowing any application to use GUI Scripting once the "Enable access for assistive devices" checkbox in the Universal Access panel of System Preferences was enabled.

#### Remote Apple Events

If including user names and/or passwords in remote application URLs (not recommended), please note that appscript retains these URLs in both the `terminology` module's internal cache and in the `app` objects created with those URLs. Security here is the user's responsibility, as it's their code that creates and retains these objects.

### AEDescs

Some applications (e.g. QuarkXpress) may return values which appscript cannot convert to equivalent Python types. These values are usually of types which are defined, used and understood only by that particular application, and will be represented in Python as raw `aem.ae.AEDesc` objects. While there's not much you can do with raw `AEDesc` objects within Python (it's best just to treat them as opaque types), subsequent commands can pass them back to the application for further use and/or conversion just like any other value.

### Event loops

Python-based applications that use a Carbon/Cocoa event loop can import the `appscript` module as normal, but should not use it before the event loop has started as sending Apple events outwith the main event loop can disrupt the process's normal event handling.

### Credits

Many thanks to Philip Aker, Ben Artin, Jack Jansen, Jordan K Hubbard, Bob Ippolito, Thomas Loredo, Jacob Kaplan-Moss, Georges Martin, Nick Matsakis, Larry McMunn, Chris Nandor, Chris Nebel, Matt Neuburg, Ronald Oussoren, David Person, Donovan Preston, Jon Pugh, Jay Soffian, Clayton Wheeler, Kevin Van Vechten, and all the appscript users who've provided comments, criticisms and encouragement along the way. Special thanks to those who've donated to the development and upkeep of this project.

### Website

http://appscript.sourceforge.net