1

In Windows command line, first nine arguments can be referenced as %1...%9. Even without the quotes, %1 represents the first argument, which from decent browsers will be a URL escaped and quoted full URL. If this was a problem per se, the defaults for e.g. http://, https:// and ftp:// would be vulnerable, the shell\open\command being "C:\Program Files\...


1

Yes, this should be sufficient to prevent malicious websites from executing additional unexpected commands. Chromium both escapes and quotes the url before passing it to the protocol handler, and I expect other browsers do the same, since not doing so would be a major vulnerability.


Only top voted, non community-wiki answers of a minimum length are eligible