windowsLaunchArguments static method

  1. @visibleForTesting
List<String> windowsLaunchArguments(
  1. String url
)

Builds a PowerShell invocation with the URL encoded as data, never code.

cmd /c start is unsafe here: even ordinary query separators (&) are shell syntax, and percent-encoded URLs can trigger variable expansion.

Implementation

@visibleForTesting
static List<String> windowsLaunchArguments(String url) {
  final data = base64Encode(utf8.encode(url));
  final script =
      "\$ErrorActionPreference = 'Stop'; "
      "Start-Process -FilePath ([Text.Encoding]::UTF8.GetString("
      "[Convert]::FromBase64String('$data')))";
  // powershell.exe requires UTF-16LE for -EncodedCommand.
  final encoded = base64Encode([
    for (final unit in script.codeUnits) ...[unit & 0xff, unit >> 8],
  ]);
  return ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded];
}