Open Windows transcript URLs without cmd /c

cmd.exe re-parses the assembled command line, so &, | and && in an attacker-influenceable transcript URL would execute as command separators. Route win32 through rundll32 url.dll,FileProtocolHandler with the URL as a plain argv element instead; no shell is involved on any platform.

Author: TheGreatAxios

docs/TUI.md

@@ -829,8 +829,8 @@ running its own selection. Two chords cover remaining copy needs:
     support OSC-8, so Cmd+click does nothing there; iTerm2 3.5+, Ghostty,
     WezTerm, Kitty, and VS Code support it.
   - **Linux/Windows: Ctrl+click.** The app opens the URL through the
-    platform opener (`open` on macOS as fallback, `xdg-open`, `cmd /c
-start`).
+    platform opener (`open` on macOS as fallback, `xdg-open`, `rundll32
+    url.dll,FileProtocolHandler` — argv spawns, never through a shell).
   - **Right-click safety.** The open gesture requires a left (button-0)
     press with the modifier held, so Ctrl+right-click never opens a URL —
     context menus stay safe.
@@ -921,7 +921,7 @@ terminal. It cannot observe:
   Ctrl+drag do not, non-`http(s)` never opens) with a mocked opener, but
   only a real terminal can show whether it delivers the held Ctrl on motion
   and press events, whether it honors OSC-8 for Cmd+click, or resolves the
-  `open`/`xdg-open` spawn into a browser.
+  `open`/`xdg-open`/`rundll32` spawn into a browser.
 - **The system clipboard.** `system-clipboard.ts`'s helper-binary spawns and
   OSC 52 fallback are exercised with mocked spawn functions in tests; no
   test round-trips through a real `pbcopy`/`xclip`/terminal clipboard.

src/tui/url-links.ts

@@ -166,13 +166,21 @@ export function isUrlOpenClick(
 
 export type UrlOpener = (url: string) => void;
 
+/**
+ * Argv for opening a URL with the platform handler, without a shell. Windows
+ * must never route through `cmd /c start`: cmd.exe re-parses the assembled
+ * command line, so `&`, `|` and `&&` in an attacker-influenceable transcript
+ * URL would execute as command separators. `rundll32 url.dll,FileProtocolHandler`
+ * takes the URL as a plain argv element instead.
+ */
+export function platformUrlCommand(platform: string, url: string): string[] {
+  if (platform === "darwin") return ["open", url];
+  if (platform === "win32") return ["rundll32", "url.dll,FileProtocolHandler", url];
+  return ["xdg-open", url];
+}
+
 function defaultUrlOpener(url: string): void {
-  const command =
-    process.platform === "darwin"
-      ? ["open", url]
-      : process.platform === "win32"
-        ? ["cmd", "/c", "start", "", url]
-        : ["xdg-open", url];
+  const command = platformUrlCommand(process.platform, url);
   try {
     Bun.spawn(command, {
       stdout: "ignore",

tests/unit/tui/url-links.test.ts

@@ -4,6 +4,7 @@ import {
   isOpenableUrl,
   isUrlOpenClick,
   openUrl,
+  platformUrlCommand,
   setUrlOpener,
   resetUrlOpener,
   splitLinkSpans,
@@ -123,6 +124,29 @@ describe("isUrlOpenClick", () => {
   });
 });
 
+describe("platformUrlCommand", () => {
+  test("windows opens without cmd /c so metacharacters never parse", () => {
+    const url = "https://example.com/x?a=1&b=2";
+    expect(platformUrlCommand("win32", url)).toEqual([
+      "rundll32",
+      "url.dll,FileProtocolHandler",
+      url,
+    ]);
+    expect(platformUrlCommand("win32", url)).not.toContain("cmd");
+  });
+
+  test("darwin and linux use their openers with the URL as argv", () => {
+    expect(platformUrlCommand("darwin", "https://example.com")).toEqual([
+      "open",
+      "https://example.com",
+    ]);
+    expect(platformUrlCommand("linux", "https://example.com")).toEqual([
+      "xdg-open",
+      "https://example.com",
+    ]);
+  });
+});
+
 describe("openUrl", () => {
   test("calls the opener with the exact URL (mocked)", () => {
     const calls: string[] = [];