New Features
cargo runnow shows the exact commands that were tried when opening.
This is useful for debugging, mainly.
Bug Fixes
-
Align WSL PowerShell invocation with Windows
Pass the WSL open target to PowerShell through the OPEN_RS_TARGET
environment variable instead of embedding it in the command string and
escaping it as a single-quoted PowerShell value.This matches the safer invocation already used by the native Windows
backend. Keeping the PowerShell program fixed ensures that paths and URLs
are treated purely as data, even when they contain quotes, semicolons, or
other PowerShell metacharacters. It also removes the need for custom
PowerShell quoting and avoids converting the target through
to_string_lossy() during command construction.Add -NonInteractive for consistency with the Windows launcher and update
the WSL tests to verify both the fixed command and the unchanged
environment-variable value. -
prevent launcher option and shell injection
Opening an attacker-controlled dash-leading path could be interpreted as
launcher options. On Windows, cmd /c start also parsed embedded quotes and
metacharacters as command language, while the legacy gnome-open fallback
could load a module even after a double-dash separator.Add command-construction regressions for malicious option-shaped paths and
Windows shell metacharacters. Use supported separators on macOS and KDE, and
rewrite dash-leading relative paths for launchers without separator support.
Keep Windows values out of shell syntax by passing the default target through
the environment and invoking custom applications directly, with explorer.exe
as a PowerShell-free fallback.Exclude cmd-based opening by default, while providing an
explicit insecure Cargo feature for users who need compatibility it
and accept their unsafe handling of untrusted input.Validated with default and all-feature cargo tests, clippy, and cross-target
cargo check --tests for aarch64 Linux and Windows.
Commit Statistics
- 5 commits contributed to the release.
- 3 commits were understood as conventional.
- 1 unique issue was worked on: #124