Check for single apostrophe in OpenURL()
When doinga8dffc63fb
I was not aware that printing a warning and not executing the code would be an option. I only learned that through618f220851
. So I propose that we allow all URLs except if the string contains a `'`. Which could end the URL and call another command via `system()`. Related to https://github.com/raysan5/raylib/issues/686
This commit is contained in:
parent
618f220851
commit
8f70c3baed
23
src/core.c
23
src/core.c
@ -1828,24 +1828,10 @@ void OpenURL(const char *url)
|
||||
{
|
||||
// Small security check trying to avoid (partially) malicious code...
|
||||
// sorry for the inconvenience when you hit this point...
|
||||
bool validUrl = true;
|
||||
int len = strlen(url);
|
||||
|
||||
for (int i = 0; i < len; i++)
|
||||
{
|
||||
if ((url[i] == ';') ||
|
||||
(url[i] == '?') ||
|
||||
(url[i] == ':') ||
|
||||
(url[i] == '=') ||
|
||||
(url[i] == '&'))
|
||||
{
|
||||
validUrl = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (validUrl)
|
||||
if (strchr(url, '\'') != NULL)
|
||||
{
|
||||
TraceLog(LOG_WARNING, "Provided URL does not seem to be valid.");
|
||||
} else {
|
||||
char *cmd = calloc(strlen(url) + 10, sizeof(char));
|
||||
|
||||
#if defined(_WIN32)
|
||||
@ -1856,10 +1842,9 @@ void OpenURL(const char *url)
|
||||
sprintf(cmd, "open '%s'", url);
|
||||
#endif
|
||||
system(cmd);
|
||||
|
||||
|
||||
free(cmd);
|
||||
}
|
||||
else TraceLog(LOG_WARNING, "Provided URL does not seem to be valid.");
|
||||
}
|
||||
|
||||
//----------------------------------------------------------------------------------
|
||||
|
Loading…
Reference in New Issue
Block a user