MrMonopoly/raylib
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow & in URLs for query parameters in OpenURL()

Browse Source 
Remove & from rejected shell metacharacters since URLs legitimately
use & for query parameters (e.g., ?key=val&key2=val2). The remaining
checks still prevent command injection via other metacharacters.
This commit is contained in:
Srikanth Patchava 2026-04-25 04:51:15 -07:00
parent 872dbb7264
commit 674e4c863b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/platforms/rcore_desktop_glfw.c
View File

@ -1192,9 +1192,9 @@ void OpenURL(const char *url)
{
// Security check to avoid malicious code injection
if (strchr(url, '\'') != NULL || strchr(url, '"') != NULL ||
strchr(url, '&') != NULL || strchr(url, '|') != NULL ||
strchr(url, ';') != NULL || strchr(url, '`') != NULL ||
strchr(url, '$') != NULL || strchr(url, '\\') != NULL)
strchr(url, '|') != NULL || strchr(url, ';') != NULL ||
strchr(url, '`') != NULL || strchr(url, '$') != NULL ||
strchr(url, '\\') != NULL)
{
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL contains potentially dangerous characters");
}