From dcc75c980bd0786de9a266ef466cd33801bd56d5 Mon Sep 17 00:00:00 2001
From: ZacharyZcR <zacharyzcr1984@gmail.com>
Date: Wed, 13 May 2026 16:30:41 +0800
Subject: [PATCH] fix: validate terminal link URLs before opening in external
 browser

---
 electron/main.cjs                     | 9 ++++++++-
 src/ui/features/terminal/Terminal.tsx | 7 ++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/electron/main.cjs b/electron/main.cjs
index d536bdfd..1330e5f5 100644
--- a/electron/main.cjs
+++ b/electron/main.cjs
@@ -953,7 +953,14 @@ function createWindow() {
   });
 
   mainWindow.webContents.setWindowOpenHandler(({ url }) => {
-    shell.openExternal(url);
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+        shell.openExternal(url);
+      }
+    } catch {
+      // invalid URL, ignore
+    }
     return { action: "deny" };
   });
 }
diff --git a/src/ui/features/terminal/Terminal.tsx b/src/ui/features/terminal/Terminal.tsx
index 901bb2cd..6c263ff3 100644
--- a/src/ui/features/terminal/Terminal.tsx
+++ b/src/ui/features/terminal/Terminal.tsx
@@ -1938,7 +1938,12 @@ const TerminalInner = forwardRef<TerminalHandle, SSHTerminalProps>(
       const clipboardProvider = new RobustClipboardProvider();
       const clipboardAddon = new ClipboardAddon(undefined, clipboardProvider);
       const unicode11Addon = new Unicode11Addon();
-      const webLinksAddon = new WebLinksAddon();
+      const webLinksAddon = new WebLinksAddon((_event, uri) => {
+        const url = uri.startsWith("http://") || uri.startsWith("https://")
+          ? uri
+          : `https://${uri}`;
+        window.open(url, "_blank");
+      });
 
       fitAddonRef.current = fitAddon;
       terminal.loadAddon(fitAddon);