Description
Describe the request
This feature request is based on #2027 (review).
External library contributors can specify any meaningful content for a library, including URLs. IDE2 renders these links on the UI, and the URL links are clickable, but IDE2 cannot guarantee anything regarding the links. For example, VS Code asks the user before opening a link not among the trusted domains. It's still possible to open untrusted URLs from Code without user confirmation, though, so it could be better. IDE2 opens every link without asking.
Acceptance criteria:
- IDE2 should validate the URLs before opening them in the users' default browser.
- IDE2 should raise a confirmation dialog when opening untrusted (other than arduino.cc) URLs to prevent users from landing on an undesired page.
Describe the current behavior
IDE2 opens any links in the default browser without prompting the user.
Arduino IDE version
2.1.0
Operating system
macOS
Operating system version
12.6.3
Additional context
Related links and best practices:
- https://benjamin-altpeter.de/shell-openexternal-dangers
- https://positive.security/blog/url-open-rce
- Here is the corresponding VS Code documentation.
- Here is how VS Code handles trusted domains at the code level.
- Eclipse Theia: vscode: Support trusted commands in markdown and webviews
- Eclipse Theia: [vscode] Implement full Workspace Trust behavior
IDE2 renders these links on the UI, and the URL links are clickable
The Arduino security team has suggested not to render a link on the UI clickable if the URL scheme is not http, https, or mailto.
Suggested pseudo code:
// examples:
// external_url_string = "https://maliciouswebsite/"
// external_url_string = "sftp://1.1.1.1"
...
// in general, i prefer call native parser instead implement regex, i consider it safer and more readable
parsed_url_obj = URL(external_url_string)
if (parsed_url.protocol == 'https' or parsed_url.protocol == 'http' or parsed_url.protocol == 'mailto'){
// the URL is acceptable, ask confirmation to user
OpenConfirmDialog(...,"_blank",callback(...))
} else {
// render it as not clickable string
}
...
Issue checklist
- I searched for previous requests in the issue tracker
- I verified the feature was still missing when using the latest nightly build
- My request contains all necessary details