GHSL-2020-145: escape ^ character to prevent code injection attacks

[kevinbackhouse]

On Windows, opener does not escape the ^ character which can lead to code injection. For example:

const opener = require("opener");
opener(`https://github.com/${user}`);

If ${user} is the string ^&calc, then on Windows this code will open the (meaningless) url https://github.com/%5E in a browser and launch calc.exe.

We discussed this privately with the maintainer, who says that this is not a vulnerability because opener's entire purpose is to execute arbitrary commands.

[domenic]

Thank you!