Security: changelog links open via xdg-open with no URL scheme validation

[CryptoFewka]

Summary

bol/gui.py's changelog link handler on_link_click runs xdg-open on a URL taken directly from changelog content, with no URL-scheme validation:

def on_link_click(event):
    idx = widget.index(f"@{event.x},{event.y}")
    for tag in widget.tag_names(idx):
        if tag.startswith("url:"):
            url = tag[4:]
            subprocess.Popen(["xdg-open", url],
                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
            break

The url: tag is built from attacker-influenceable changelog data:

• Launcher (markdown) changelog: the markdown link capture group becomes f"url:{url}".
• Game (HTML) changelog: the HTML href attribute becomes f"url:{self.current_href}".

Because there is no scheme allowlist, a changelog entry with [text](file:///…) or any registered URI scheme (ms-…, custom app handlers) is passed to xdg-open, which dispatches by scheme to a local handler.

Impact

Severity: Medium, defense-in-depth. The invocation is argv-form, so there is no shell-injection vector. Exploitation requires controlling the changelog source (the project's own GitHub release notes served over HTTPS, plus the Minecraft feedback API), so it is not trivially remote. Still, launcher UI should never hand an unvalidated, non-web URI to xdg-open.

Notes

• This is pre-existing: it is present in upstream (Wyze3306/BedrockOnLinux) as well and was not introduced by any recent change. It surfaced during a full security review of the upstream 2.1.x delta.
• Suggested fix: restrict on_link_click to http/https before dispatch, e.g. reject unless urllib.parse.urlparse(url).scheme in ("http", "https").
• Intend to also contribute the fix upstream.