Merge pull request #688 from jubalh/master

Check for single apostrophe in OpenURL()
This commit is contained in:
Ray 2018-11-13 15:03:24 +01:00 committed by GitHub
commit ffcd13bd9f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1828,24 +1828,10 @@ void OpenURL(const char *url)
{ {
// Small security check trying to avoid (partially) malicious code... // Small security check trying to avoid (partially) malicious code...
// sorry for the inconvenience when you hit this point... // sorry for the inconvenience when you hit this point...
bool validUrl = true; if (strchr(url, '\'') != NULL)
int len = strlen(url);
for (int i = 0; i < len; i++)
{
if ((url[i] == ';') ||
(url[i] == '?') ||
(url[i] == ':') ||
(url[i] == '=') ||
(url[i] == '&'))
{
validUrl = false;
break;
}
}
if (validUrl)
{ {
TraceLog(LOG_WARNING, "Provided URL does not seem to be valid.");
} else {
char *cmd = calloc(strlen(url) + 10, sizeof(char)); char *cmd = calloc(strlen(url) + 10, sizeof(char));
#if defined(_WIN32) #if defined(_WIN32)
@ -1856,10 +1842,9 @@ void OpenURL(const char *url)
sprintf(cmd, "open '%s'", url); sprintf(cmd, "open '%s'", url);
#endif #endif
system(cmd); system(cmd);
free(cmd); free(cmd);
} }
else TraceLog(LOG_WARNING, "Provided URL does not seem to be valid.");
} }
//---------------------------------------------------------------------------------- //----------------------------------------------------------------------------------