[xiphos-source] [crosswire/xiphos] 7aade7: security: percent-encode clipboard selection in bi...

[Acts1631]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: 7aade771ef4576e91ad6dd4c1d1f2f0bcf08034b
      https://github.com/crosswire/xiphos/commit/7aade771ef4576e91ad6dd4c1d1f2f0bcf08034b
  Author: Acts1631 <69813585+acts-1631 at users.noreply.github.com>
  Date:   2026-07-09 (Thu, 09 Jul 2026)

  Changed paths:
    M src/gtk/menu_popup.c

  Log Message:
  -----------
  security: percent-encode clipboard selection in biblemap URL (#1346)

The "Open in Bible Map" context menu action builds a URL by
concatenating the clipboard selection directly into a URL fragment:
  g_strconcat("http://www.biblemap.org/#", dict_key, NULL)
without any percent-encoding. Characters like spaces, #, &, ?, or
newlines in the selection alter the resulting URL structure passed to
the system browser via xiphos_open_default() (gtk_show_uri_on_window on
Linux, ShellExecuteW on Windows). A selection containing a second #
hijacks the fragment; spaces can break the URL; crafted content can
confuse naive URL parsers.

Percent-encode the selection with g_uri_escape_string() before
inserting it into the URL so that URL-significant characters are
escaped and the browser receives the intended fragment.



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications