fix(security): 2 improvements across 2 files

[tomaioo]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: Medium | File: utils/gui.py:L28

In utils/gui.py, the openUrl function uses QProcess.startDetached with a user-configured browser path and a URL. While QProcess.startDetached with a list argument is generally safer than string concatenation, the browser path comes from user settings (/Qgis2threejs/browser) without validation. A malicious or malformed browser path could potentially lead to command execution if the path contains shell metacharacters or if the implementation doesn't properly handle the path. Additionally, the URL is passed as a string argument which could be manipulated.

Solution

Validate and sanitize the browserPath before use. Use shlex.quote() or similar to escape the browser path. Consider using QProcess with explicit program and arguments rather than relying on shell parsing. Verify the browser path points to an actual executable file.

Changes

• utils/gui.py (modified)
• core/plugin/pluginmanager.py (modified)

[minorua]

Changing the Qgis2threejs browserPath setting to launch a malicious program is theoretically possible. However, such an attack vector is highly indirect, given that a malicious QGIS plugin already has the ability to execute arbitrary code on the user's system. Additionally, since QProcess.startDetached() passes the program and its arguments separately without invoking a shell, the typical OS command injection vector is effectively eliminated.

Furthermore, this browser path setting is a legacy feature from early versions of Qgis2threejs, originally intended to open exported web pages locally. The upcoming version uses ES modules, which modern browsers block when loaded via the file:// protocol due to CORS restrictions.

Since a local HTTP server is now required to view exported pages and this setting has become obsolete, I will remove the browser path configuration rather than patch it.