SIGN IN SIGN UP
microsoft / terminal UNCLAIMED

The new Windows Terminal and the original Windows console host, all in the same place!

0 0 92 C++

Display a warning dialog for unsafe URLs (#20065)

We are getting a sufficient number of LLM-generated security reports
telling us that Ctrl+click and a tooltip are insufficient protection
from users clicking on links to dangerous things.

This commit displays a warning that prevents users from blindly clicking
on dangerous things.

Dangerous things include:
- any non-http and non-https and non-file URLs
- any file URLs that point to something understandable as a "program"
(so, something which resides in `PATHEXT`.)

In doing this, I learned that `til::ends_with_insensitive_ascii` was
broken.

I also learned that ContentDialogs summoned by any event handler out of
TermControl::Pointer* would lose focus immediately. It turns out that in
the absolute earliest days of Terminal, when we first created the
UserControl that became TermControl, we added our Tapped event handler.

It unconditionally focused the control.

Since `Tapped` is a higher-level event handler than `PointerPressed`, it
was firing after the gesture that opened the content dialog and stealing
focus back.

I'm fairly certain we don't need it.

Refs #7562
D
Dustin L. Howett committed
81170aff78dc10c5673930b4cd107cf3d3705336
Parent: c90ace8
Committed by GitHub <noreply@github.com> on 4/7/2026, 4:23:15 PM