quartznet/raylib
Watch
3
0
Fork
You've already forked raylib
 0
Code Issues Pull requests Releases 25 Activity

REVIEWED: OpenURL(), added some safety checks to mitigate possible malicious url inputs

Browse source
This commit is contained in:
Ray 2026-07-07 11:45:30 +02:00
commit f8e42cb509
1 changed files with 106 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/platforms/rcore_template.c
View file

@ -352,14 +352,22 @@ double GetTime(void)
}
// Open URL with default system browser (if available)
// NOTE: This function is only safe to use if you control the URL given.
// A user could craft a malicious string performing another action.
// Only call this function yourself not with user input or make sure to check the string yourself.
// Ref: https://github.com/raysan5/raylib/issues/686
// WARNING: This function is only safe to use if you control the URL given,
// a user could craft a malicious string to perform and undesired action
// NOTE: Some safety checks have been added to mitigate security issues
void OpenURL(const char *url)
{
// Security check to (partially) avoid malicious code on target platform
if (strchr(url, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'] character");
// Security check to (partially) avoid malicious code
if ((strchr(url, '\'') != NULL) || (strchr(url, '\"') != NULL))
{
// Filter characters: ' and "
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'\"] characters");
}
else if ((strncmp(url, "http://", 7) != 0) && (strncmp(protocol, "https://", 8) != 0))
{
// Only allow URL starting with "http://" or "https://" protocols
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL must start with 'http://' or 'https://' protocols");
}
else
{
// TODO: Load url using default browser