fix: prevent unsafe browser targets from issue tracker links

Author: ChiahongHong

src/Native/OS.cs

@@ -242,9 +242,26 @@ public static void OpenInFileManager(string path)
 
         public static void OpenBrowser(string url)
         {
+            if (!IsSafeBrowserTarget(url))
+            {
+                Models.Notification.Send(null, $"Blocked unsafe URL: {url}", true);
+                return;
+            }
+
             _backend.OpenBrowser(url);
         }
 
+        private static bool IsSafeBrowserTarget(string url)
+        {
+            return Uri.IsWellFormedUriString(url, UriKind.Absolute) &&
+                Uri.TryCreate(url, UriKind.Absolute, out var uri) &&
+                (
+                    uri.Scheme == Uri.UriSchemeHttp ||
+                    uri.Scheme == Uri.UriSchemeHttps ||
+                    uri.Scheme == Uri.UriSchemeFtp
+                );
+        }
+
         public static void OpenTerminal(string workdir)
         {
             if (string.IsNullOrEmpty(ShellOrTerminal))

src/Native/Windows.cs

@@ -133,7 +133,8 @@ public string FindTerminal(Models.ShellOrTerminal shell)
 
         public void OpenBrowser(string url)
         {
-            var info = new ProcessStartInfo("cmd", $"""/c start "" {url.Quoted()}""");
+            var info = new ProcessStartInfo(url);
+            info.UseShellExecute = true;
             info.CreateNoWindow = true;
             Process.Start(info);
         }