microsoft/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2025-12-11 04:38:24 -06:00
Code Issues Packages Projects Releases 138 Wiki Activity

Allow wsl$ in file URIs; generally allow all URI schemes (#14993)

Browse Source 
Does two things related to URLs emitted via OSC8. 

* Allows `wsl$` and `wsl.localhost` as the hostname in `file://` URIs
* Generally allows _all_ URIs that parse as a URI. 

The relevant security comments: https://github.com/microsoft/terminal/pull/7526#issuecomment-764160208
> this doesn't let a would-be attacker specify command-line arguments (ala "cmd.exe /s /c do_a_bad_thing") (using somebody else's reputation to cause mayhem)
> 
> `ShellExecute` de-elevates because it bounces a launch request off the shell
> 
> "Works predictably for 15% of applications" (h/t to PhMajerus' AXSH, and other on-Windows requestors) is better in so many ways than "Works for 0% of applications", in my estimation. Incremental progress 😄 while we work on features that'll make it even more broadly applicable.

Closes #10188
Closes #7562
This commit is contained in:
Mike Griese 2023-03-17 13:29:42 -05:00 committed by GitHub
parent 5b434dcda4
commit 65640f6fe3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/cascadia/TerminalApp/TerminalPage.cpp
View File

@ -2429,14 +2429,27 @@ namespace winrt::TerminalApp::implementation
{
return true;
}
// GH#10188: WSL paths are okay. We'll let those through.
if (host == L"wsl$" || host == L"wsl.localhost")
{
return true;
}
// TODO: by the OSC 8 spec, if a hostname (other than localhost) is provided, we _should_ be
// comparing that value against what is returned by GetComputerNameExW and making sure they match.
// However, ShellExecute does not seem to be happy with file URIs of the form
// file://{hostname}/path/to/file.ext
// and so while we could do the hostname matching, we do not know how to actually open the URI
// if its given in that form. So for now we ignore all hostnames other than localhost
return false;
}
return false;
// In this case, the app manually output a URI other than file:// or
// http(s)://. We'll trust the user knows what they're doing when
// clicking on those sorts of links.
// See discussion in GH#7562 for more details.
return true;
}
// Important! Don't take this eventArgs by reference, we need to extend the