Refactoring: Url helpers (#1789)

These changes are mainly to ensure that 'shell.open*' invocations are only in a single file.
* Moved 'openPath' into the 'url-helpers' file.
* Extract 'openExternalUrl' into a common location in 'url-helpers'

This is done so that we can then apply vetting rules to ensure that there is no security concern as described in https://benjamin-altpeter.de/shell-openexternal-dangers/

1 files changed, 16 insertions, 0 deletions

diff --git a/src/helpers/url-helpers.js b/src/helpers/url-helpers.js
index 972f9b79a..b0dc9afbb 100644
--- a/src/helpers/url-helpers.js
+++ b/src/helpers/url-helpers.js
@@ -1,4 +1,8 @@
+// This is taken from: https://benjamin-altpeter.de/shell-openexternal-dangers/
+
 import { URL } from 'url';
+import { ensureDirSync } from 'fs-extra';
+import { shell } from 'electron';
 
 import { ALLOWED_PROTOCOLS } from '../config';
 
@@ -18,3 +22,15 @@ export function isValidExternalURL(url) {
 
   return isAllowed;
 }
+
+export async function openPath(folderName) {
+  ensureDirSync(folderName);
+  shell.openPath(folderName);
+}
+
+// TODO: Need to verify and fix/remove the skipping logic. Ideally, we should never skip this check
+export function openExternalUrl(url, skipValidityCheck = false) {
+  if (skipValidityCheck || isValidExternalURL(url)) {
+    shell.openExternal(url);
+  }
+}