quartznet/raylib
Watch
3
0
Fork
You've already forked raylib
 0
Code Issues Pull requests Releases 25 Activity

REVIEWED: OpenURL(), added some safety checks to mitigate possible malicious url inputs

Browse source
This commit is contained in:
Ray 2026-07-07 11:45:30 +02:00
commit f8e42cb509
1 changed files with 106 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/platforms/rcore_web_emscripten.c
View file

@ -968,13 +968,22 @@ double GetTime(void)
}
// Open URL with default system browser (if available)
// NOTE: This function is only safe to use if the provided URL is safe
// A user could craft a malicious string performing another action
// Avoid calling this function with user input non-validated strings
// WARNING: This function is only safe to use if you control the URL given,
// a user could craft a malicious string to perform and undesired action
// NOTE: Some safety checks have been added to mitigate security issues
void OpenURL(const char *url)
{
// Security check to (partially) avoid malicious code on target platform
if (strchr(url, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'] character");
// Security check to (partially) avoid malicious code
if ((strchr(url, '\'') != NULL) || (strchr(url, '\"') != NULL))
{
// Filter characters: ' and "
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'\"] characters");
}
else if ((strncmp(url, "http://", 7) != 0) && (strncmp(protocol, "https://", 8) != 0))
{
// Only allow URL starting with "http://" or "https://" protocols
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL must start with 'http://' or 'https://' protocols");
}
else emscripten_run_script(TextFormat("window.open('%s', '_blank')", url));
}