How do/will you handle hyperlinks?

[bejolly407]

If I'm reading the disclosure correctly, the issue is:

• Windows Notepad is more than just a plain text editor now.
• In particular, it has a markdown preview feature, including clickable links.
• But, it doesn't have full web browser security processes for what to do if you click on a link with a protocol that triggers a local application. It gets treated as if the user was directly running that application.

So, don't open strange files & then click links. (And update Windows regularly.)

https://front-end.social/@AmeliaBR/116049911558312134

https://lobste.rs/s/kp7jlq/windows_notepad_app_remote_code

I want to know the way you are currently handling hyperlinks in source files and what you will do in the future with Markdown.

[SpartanJ]

 I want to know the way you are currently handling hyperlinks

Nothing special? If you click an hyperlink it will call to SDL_OpenURL with that file, SDL will decide what to do with that, it will depend on the protocol (basically checks for the default program to open that protocol and opens the URL in that default program), but the only clickable protocol supported in ecode is http/s, you cannot exploit it, notepad vulnerability is just silly.

 what you will do in the future with Markdown

At some point in time a markdown preview option will be available, that's all.

[bejolly407]

I want to know the way you are currently handling hyperlinks

Nothing special? If you click an hyperlink it will call to SDL_OpenURL with that file, SDL will decide what to do with that, it will depend on the protocol (basically checks for the default program to open that protocol and opens the URL in that default program), but the only clickable protocol supported in ecode is http/s, you cannot exploit it, notepad vulnerability is just silly.

I would like to have an option to force it to ignore all hyperlinks. The hyperlinks are still highlighted, though. Should I make a FR?

what you will do in the future with Markdown

At some point in time a markdown preview option will be available, that's all.

I mean what you will do in the future with hyperlinks in Markdown.

[SpartanJ]

 I would like to have an option to force it to ignore all hyperlinks. The hyperlinks are still highlighted, though. Should I make a FR?

No, I will reject it.

 I mean what you will do in the future with hyperlinks in Markdown.

Absolutely nothing, there's nothing to do, there's no risk at all, IDK what are you thinking, the notepad CVE has nothing to do with how ecode handles hyperlinks.

[bejolly407]

I would like to have an option to force it to ignore all hyperlinks. The hyperlinks are still highlighted, though. Should I make a FR?

No, I will reject it.

Why? What if I still want hyperlinks to be syntax-highlighted but simply don’t want the risk of accidentally opening them?

Hyperlinks themselves may not be malicious. But what if I’m editing a DNS host file full of porn and betting sites—NSFW content?

[bejolly407]

My threads are usually about real issues, not made-up content like the trolls. Please don’t treat me that way!

[SpartanJ]

 Why? What if I still want hyperlinks to be syntax-highlighted but simply don’t want the risk of accidentally opening them?

The problem is that it would be baby sit the user, in a code editor there are plenty of "dangerous" actions you can take, I don't believe it's reasonable to baby sit a user in a code editor, I personally don't like software that behaves like that.

 Hyperlinks themselves may not be malicious. But what if I’m editing a DNS host file full of porn and betting sites—NSFW content?

That's a stretch IMHO.

 My threads are usually about real issues, not made-up content like the trolls. Please don’t treat me that way!

Sorry If i'm being too direct but I don't believe this is an issue or justifies a new feature. If you think this is really useful and you need that feature you're more than invited to implement it, if it's not too intrusive and it's properly implemented I'll accept it.