core-agent-linux/qubes-rpc/qubes.OpenURL

#!/bin/sh

read -r url

case "$url" in
    http://*|\
    https://*|\
    ftp://*)
        exec qubes-open "$url"
        ;;
    *)
        echo "Invalid URL" >&2
        exit 1
        ;;
esac
Implement qubes.OpenURL service instead of wrapping URLs in HTML This have many advantages: - prevent XSS (QubesOS/qubes-issues#1462) - use default browser instead of default HTML viewer - better qrexec policy control - easier to control where are opened files vs URLs For now allow only http(s):// and ftp:// addresses (especially prevent file://). But this list can be easily extended. QubesOS/qubes-issues#1462 Fixes QubesOS/qubes-issues#1487 2016-05-17 21:50:20 +02:00			`#!/bin/sh`

qubes-rpc: fix issues found by shellcheck Most of them are missing quotes, `` -> $(), and -o/-a usage in conditions. Also add few directives disabling checks where were too verbose. 2017-09-30 04:45:31 +02:00			`read -r url`
Implement qubes.OpenURL service instead of wrapping URLs in HTML This have many advantages: - prevent XSS (QubesOS/qubes-issues#1462) - use default browser instead of default HTML viewer - better qrexec policy control - easier to control where are opened files vs URLs For now allow only http(s):// and ftp:// addresses (especially prevent file://). But this list can be easily extended. QubesOS/qubes-issues#1462 Fixes QubesOS/qubes-issues#1487 2016-05-17 21:50:20 +02:00
			`case "$url" in`
			`http://*\|\`
			`https://*\|\`
			`ftp://*)`
			`exec qubes-open "$url"`
			`;;`
			`*)`
			`echo "Invalid URL" >&2`
			`exit 1`
			`;;`
			`esac`