@bobfrankston/rmfmail 1.2.3 → 1.2.4

package/packages/mailx-service/index.js

@@ -2844,6 +2844,51 @@ export class MailxService {
         }
         return { ok: true, path: target };
     }
+    /** Open an http/https/mailto URL in the OS default browser/handler from the
+     *  Node process. The UI used to rely on `window.open(url, "_blank")`, but
+     *  inside msger's WebView2 that opens a local in-app window (or no-ops)
+     *  rather than the system browser — so clicking a link in a message, or an
+     *  unsubscribe "click here", "stayed local" (Bob 2026-06-13, "old bug
+     *  back"). `mailxapi.openExternal` now routes here.
+     *
+     *  Security: the URL comes from untrusted email. We (1) parse it and allow
+     *  ONLY http/https/mailto — no file:, javascript:, data:, etc. — and (2)
+     *  pass it as a single spawn ARG with no shell, and on Windows use rundll32
+     *  (not `cmd /c start`, which re-parses `&`/`^` in query strings and is
+     *  injection-prone). Same cross-platform spawn pattern as openAttachment. */
+    async openExternal(url) {
+        let u;
+        try {
+            u = new URL(String(url));
+        }
+        catch {
+            return { ok: false, reason: "unparseable URL" };
+        }
+        if (!["http:", "https:", "mailto:"].includes(u.protocol)) {
+            console.error(`  [openExternal] refused non-web scheme: ${u.protocol}`);
+            return { ok: false, reason: `unsupported scheme ${u.protocol}` };
+        }
+        const target = u.href;
+        try {
+            const { spawn } = await import("node:child_process");
+            if (process.platform === "win32") {
+                // rundll32 receives the URL as a direct argv — no cmd, so query
+                // strings with & can't break out into a second command.
+                spawn("rundll32", ["url.dll,FileProtocolHandler", target], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+            }
+            else if (process.platform === "darwin") {
+                spawn("open", [target], { detached: true, stdio: "ignore" }).unref();
+            }
+            else {
+                spawn("xdg-open", [target], { detached: true, stdio: "ignore" }).unref();
+            }
+            return { ok: true };
+        }
+        catch (e) {
+            console.error(`  [openExternal] spawn failed: ${e?.message || e}`);
+            return { ok: false, reason: e?.message || String(e) };
+        }
+    }
     // ── Drafts ──
     async saveDraft(accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid, draftId) {
         // Local-first: commit the draft to the local filesystem synchronously