Command arguments not escaped when opening link/email addresses

[Torbjörn Lönnemark]

When executing xdg-{open,email} to open a URL, the URL is not escaped properly.

This becomes evident when opening a URL like:

  http://example.com/"

Where sakura shows an error dialog:

  Couldn't exec ".../xdg-open http://example.com"": Text ended before matching quote was found for ". [...]

This *could* be fixed by escaping the arguments, but it would be better to use g_spawn_async and construct the argv array manually rather than building a command line string and then parsing it immediately afterwards (which g_spawn_command_line_async does).

This is probably not a security issue. Because glib parses the command line internally and calls exec using the resulting argv array (the command string is not passed directly to sh), meaning injection of shell control characters should not be possible.

Attaching a patch with a fix.

[David Gómez (dabisu)]

Thanks, patch commited.