fix: RCE vulnerability from CVE-2025-11953

[thymikee]

Summary

Continuation of the fix that landed in 1508990, that prevents RCE using a spoofed URL with | character, such as: https://evil.com?|calc.exe.

cc @633kh4ck @mbaraniak-exodus

[mbaraniak-exodus]

@thymikee,
The fix seems reasonable, unless you switch in the future to a new version of open, which uses PS underneath. Then you will need escape also $ (, etc.
Be aware of (non-default) delayed expansion, which will make such syntax possible !VAR!

[633kh4ck]

To be specific, it encodes special characters, but only sets of them in each URL part ¹. For example, | is encoded in userinfo:

new URL('https://user|:[email protected]')`
// https://user%7C:[email protected]/

Current implementation double-encodes several characters for that reason; for example, whitespaces:

const parsedUrl = new URL('https://example.com/?#some hash')
// https://example.com/?#some%20hash
const sanitizedUrl = new URL(parsedUrl.origin);
// ...
console.log(sanitizedUrl.href)
// https://example.com/#some%2520hash

A simpler approach could be:

const sanitizedUrl = encodeURI(url);

Footnotes

1. https://url.spec.whatwg.org/#percent-encoded-bytes ↩

[633kh4ck]

Would be good to also test for <, >, `, and ｜¹ (don't confuse with | ²).

Footnotes

1. https://worst.fit/mapping/#to%3A0x7c ↩

2. https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/ ↩

[633kh4ck]

This is likely still fragile, but better than it was.

On a side note, this can (still) be exploited to exfiltrate some environment variables; possibilities are more limited, though. For example, https://example.com/?a=%¾TA% is encoded to https://example.com/?a=%25%C2%BETA%25 (note %BETA%).