starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-05-17 15:36:35 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Display a warning dialog for unsafe URLs (#20065)

Browse Source 
We are getting a sufficient number of LLM-generated security reports
telling us that Ctrl+click and a tooltip are insufficient protection
from users clicking on links to dangerous things.

This commit displays a warning that prevents users from blindly clicking
on dangerous things.

Dangerous things include:
- any non-http and non-https and non-file URLs
- any file URLs that point to something understandable as a "program"
(so, something which resides in `PATHEXT`.)

In doing this, I learned that `til::ends_with_insensitive_ascii` was
broken.

I also learned that ContentDialogs summoned by any event handler out of
TermControl::Pointer* would lose focus immediately. It turns out that in
the absolute earliest days of Terminal, when we first created the
UserControl that became TermControl, we added our Tapped event handler.

It unconditionally focused the control.

Since `Tapped` is a higher-level event handler than `PointerPressed`, it
was firing after the gesture that opened the content dialog and stealing
focus back.

I'm fairly certain we don't need it.

Refs #7562

(cherry picked from commit 81170aff78)
Service-Card-Id: PVTI_lADOAF3p4s4BBcTlzgpOYmk
Service-Version: 1.24
This commit is contained in:
Dustin L. Howett
2026-04-07 11:23:15 -05:00
committed by Dustin L. Howett
parent 69b3e7a8f5
commit cdd636d146
6 changed files with 70 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/cascadia/TerminalApp/Resources/en-US/Resources.resw
View File

@@ -715,9 +715,15 @@
<data name="UnsupportedSchemeText" xml:space="preserve">
<value>This link type is currently not supported:</value>
</data>
<data name="CouldNotOpenUriDialog.PrimaryButtonText" xml:space="preserve">
<data name="UriErrorDialog.CloseButtonText" xml:space="preserve">
<value>Cancel</value>
</data>
<data name="UnsafeUrlConfirmText" xml:space="preserve">
<value>This link may lead to an unsafe location. Hyperlinks can be harmful to your computer and data. To protect your computer, only click links from trusted sources.</value>
</data>
<data name="UnsafeUrlConfirmAllowAction" xml:space="preserve">
<value>Open anyway</value>
</data>
<data name="SettingsTab" xml:space="preserve">
<value>Settings</value>
</data>

59
src/cascadia/TerminalApp/TerminalPage.cpp
View File

@@ -3032,18 +3032,42 @@ namespace winrt::TerminalApp::implementation
}
CATCH_LOG();
void TerminalPage::_OpenHyperlinkHandler(const IInspectable /*sender*/, const Microsoft::Terminal::Control::OpenHyperlinkEventArgs eventArgs)
safe_void_coroutine TerminalPage::_OpenHyperlinkHandler(const IInspectable /*sender*/, const Microsoft::Terminal::Control::OpenHyperlinkEventArgs eventArgs)
{
try
{
auto parsed = winrt::Windows::Foundation::Uri(eventArgs.Uri());
auto uriString{ eventArgs.Uri() };
auto parsed = winrt::Windows::Foundation::Uri(uriString);
if (_IsUriSupported(parsed))
{
ShellExecute(nullptr, L"open", eventArgs.Uri().c_str(), nullptr, nullptr, SW_SHOWNORMAL);
bool shouldLaunch{ _IsUriConsideredSomewhatSafe(parsed) };
if (!shouldLaunch)
{
if (auto presenter{ _dialogPresenter.get() })
{
// FindName needs to be called first to actually load the xaml object
auto unopenedUriDialog = FindName(L"UriErrorDialog").try_as<WUX::Controls::ContentDialog>();
// Insert the reason and the URI
unopenedUriDialog.SecondaryButtonText(RS_(L"UnsafeUrlConfirmAllowAction"));
CouldNotOpenUriReason().Text(RS_(L"UnsafeUrlConfirmText"));
UnopenedUri().Text(uriString);
// Show the dialog
auto result = co_await presenter.ShowDialog(unopenedUriDialog);
shouldLaunch = result == ContentDialogResult::Secondary;
}
}
if (shouldLaunch)
{
ShellExecuteW(nullptr, L"open", uriString.c_str(), nullptr, nullptr, SW_SHOWNORMAL);
}
}
else
{
_ShowCouldNotOpenDialog(RS_(L"UnsupportedSchemeText"), eventArgs.Uri());
_ShowCouldNotOpenDialog(RS_(L"UnsupportedSchemeText"), uriString);
}
}
catch (...)
@@ -3063,9 +3087,10 @@ namespace winrt::TerminalApp::implementation
if (auto presenter{ _dialogPresenter.get() })
{
// FindName needs to be called first to actually load the xaml object
auto unopenedUriDialog = FindName(L"CouldNotOpenUriDialog").try_as<WUX::Controls::ContentDialog>();
auto unopenedUriDialog = FindName(L"UriErrorDialog").try_as<WUX::Controls::ContentDialog>();
// Insert the reason and the URI
unopenedUriDialog.SecondaryButtonText({});
CouldNotOpenUriReason().Text(reason);
UnopenedUri().Text(uri);
@@ -3118,6 +3143,30 @@ namespace winrt::TerminalApp::implementation
return true;
}
bool TerminalPage::_IsUriConsideredSomewhatSafe(const winrt::Windows::Foundation::Uri& parsedUri)
{
if (parsedUri.SchemeName() == L"http" || parsedUri.SchemeName() == L"https")
{
return true;
}
if (parsedUri.SchemeName() == L"file")
{
static const auto pathext{ wil::TryGetEnvironmentVariableW<std::wstring>(L"PATHEXT") };
const auto filename = parsedUri.Path();
for (const auto& e : til::split_iterator{ std::wstring_view{ pathext }, L';' })
{
if (til::ends_with_insensitive_ascii(filename, e))
{
return false;
}
}
return true;
}
return false;
}
// Important! Don't take this eventArgs by reference, we need to extend the
// lifetime of it to the other side of the co_await!
safe_void_coroutine TerminalPage::_ControlNoticeRaisedHandler(const IInspectable /*sender*/,

5
src/cascadia/TerminalApp/TerminalPage.h
View File

@@ -416,8 +416,9 @@ namespace winrt::TerminalApp::implementation
safe_void_coroutine _PasteFromClipboardHandler(const IInspectable sender,
const Microsoft::Terminal::Control::PasteFromClipboardEventArgs eventArgs);
void _OpenHyperlinkHandler(const IInspectable sender, const Microsoft::Terminal::Control::OpenHyperlinkEventArgs eventArgs);
bool _IsUriSupported(const winrt::Windows::Foundation::Uri& parsedUri);
safe_void_coroutine _OpenHyperlinkHandler(const IInspectable sender, const Microsoft::Terminal::Control::OpenHyperlinkEventArgs eventArgs);
static bool _IsUriSupported(const winrt::Windows::Foundation::Uri& parsedUri);
static bool _IsUriConsideredSomewhatSafe(const winrt::Windows::Foundation::Uri& parsedUri);
void _ShowCouldNotOpenDialog(winrt::hstring reason, winrt::hstring uri);
bool _CopyText(bool dismissSelection, bool singleLine, bool withControlSequences, Microsoft::Terminal::Control::CopyFormat formats);

8
src/cascadia/TerminalApp/TerminalPage.xaml
View File

@@ -144,17 +144,17 @@
</TextBlock>
</ContentDialog>
<ContentDialog x:Name="CouldNotOpenUriDialog"
x:Uid="CouldNotOpenUriDialog"
<ContentDialog x:Name="UriErrorDialog"
x:Uid="UriErrorDialog"
Grid.Row="2"
x:Load="False"
DefaultButton="Primary">
DefaultButton="Close">
<TextBlock IsTextSelectionEnabled="True"
TextWrapping="WrapWholeWords">
<TextBlock.ContextFlyout>
<mtu:TextMenuFlyout />
</TextBlock.ContextFlyout>
<Run x:Name="CouldNotOpenUriReason" /> <LineBreak />
<Run x:Name="CouldNotOpenUriReason" /> <LineBreak /> <LineBreak />
<Run x:Name="UnopenedUri"
FontFamily="Cascadia Mono" />
</TextBlock>

2
src/cascadia/TerminalControl/TermControl.cpp
View File

@@ -1993,8 +1993,6 @@ namespace winrt::Microsoft::Terminal::Control::implementation
// - args: event data
void TermControl::_TappedHandler(const IInspectable& /*sender*/, const TappedRoutedEventArgs& e)
{
Focus(FocusState::Pointer);
if (e.PointerDeviceType() == Windows::Devices::Input::PointerDeviceType::Touch)
{
// Normally TSF would be responsible for showing the touch keyboard, but it's buggy for us:

4
src/inc/til/string.h
View File

@@ -228,7 +228,7 @@ namespace til // Terminal Implementation Library. Also: "Today I Learned"
constexpr bool ends_with_insensitive_ascii(const std::basic_string_view<T, Traits>& str, const std::basic_string_view<T, Traits>& suffix) noexcept
{
#pragma warning(suppress : 26481) // Don't use pointer arithmetic. Use span instead (bounds.1).
return str.size() >= suffix.size() && equals_insensitive_ascii<>({ str.data() - suffix.size(), suffix.size() }, suffix);
return str.size() >= suffix.size() && equals_insensitive_ascii<>({ str.data() + str.size() - suffix.size(), suffix.size() }, suffix);
}
constexpr bool ends_with_insensitive_ascii(const std::string_view& str, const std::string_view& prefix) noexcept
@@ -238,7 +238,7 @@ namespace til // Terminal Implementation Library. Also: "Today I Learned"
constexpr bool ends_with_insensitive_ascii(const std::wstring_view& str, const std::wstring_view& prefix) noexcept
{
return ends_with<>(str, prefix);
return ends_with_insensitive_ascii<>(str, prefix);
}
template<typename T, typename Traits>