fix: RCE vulnerability from CVE-2025-11953

[thymikee]

Summary

Continuation of the fix that landed in 1508990, that prevents RCE using a spoofed URL with | character, such as: https://evil.com?|calc.exe.

cc @633kh4ck@mbaraniak-exodus

[mbaraniak-exodus]

@thymikee,
The fix seems reasonable, unless you switch in the future to a new version of open, which uses PS underneath. Then you will need escape also $(, etc.
Be aware of (non-default) delayed expansion, which will make such syntax possible !VAR!

[633kh4ck]

To be specific, it encodes special characters, but only sets of them in each URL part ¹. For example, | is encoded in userinfo:

newURL('https://user|:pass@example.com')`
// https://user%7C:pass@example.com/

Current implementation double-encodes several characters for that reason; for example, whitespaces:

constparsedUrl=newURL('https://example.com/?#some hash')// https://example.com/?#some%20hashconstsanitizedUrl=newURL(parsedUrl.origin);// ...console.log(sanitizedUrl.href)// https://example.com/#some%2520hash

A simpler approach could be:

constsanitizedUrl=encodeURI(url);

Footnotes

1. https://url.spec.whatwg.org/#percent-encoded-bytes↩

[633kh4ck]

Would be good to also test for <, >, `, and ｜¹ (don't confuse with |²).

Footnotes

1. https://worst.fit/mapping/#to%3A0x7c↩

2. https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/↩

[633kh4ck]

For posterity: this is likely still fragile, but better than it was.

On a side note, this can (still) be exploited to exfiltrate some environment variables; possibilities are more limited, though. For example, https://example.com/?a=%¾TA% is encoded to https://example.com/?a=%25%C2%BETA%25 (note %BETA%).

[m01e-40x]

@thymikee hi,
may I ask why this fix PR has not been merged into the main branch and the latest release version？

[thymikee]

Uh, I wanted to followup with a more robust fix, but then forgot about it. I'll try to prioritize this soon. Maintaining Community CLI is not my primary focus and anyone is free to contribute

[huntie]

@thymikee Opened #2758 as an alternative. Uses strict-url-sanitise and continues to cover logic with our own unit tests.

[thymikee]

Thank you @huntie, let's move the discussion there!