[MEDIUM] Preserve substituted browser URIs as one argument

[OskarEichler]

Summary

• parse BROWSER command templates before substituting the requested URI
• preserve the URI as one argv element even when it contains spaces or quotes
• retain the existing rendered command string for ordinary templates when it already parses safely

Security impact

Severity: MEDIUM.

When BROWSER contains a %s placeholder, Launchy currently substitutes the URI before Shellwords.shellsplit. An attacker-controlled URI can therefore become additional browser arguments; quote characters can also invalidate the command. The exact impact depends on the selected browser and its supported flags.

This is argument injection into the configured browser, not shell-command injection: ChildProcess still receives a discrete argv and does not invoke a shell.

Reproduction

With BROWSER=/usr/bin/audit-browser --new-tab '%s', the baseline turns:

https://example.test/path with space --incognito

into four argv elements after the executable. A URI containing a single quote instead raises ArgumentError during shell parsing. The candidate produces exactly three elements in both cases: executable, configured flag, and the complete URI.

Verification

• external argv model fails on main and passes for ordinary, space-containing, and quote-containing URIs on this branch
• Ruby 4.0.6: 113 existing runs, 150 assertions, 0 failures/errors/skips
• targeted RuboCop: no offenses
• all 15 runtime/executable files pass Ruby 3.2.11 syntax
• gem build/unpack succeeds with the expected 21 files
• git diff --check passes

No repository tests or dependency files were changed.

Compatibility and limitations

• No intended API or behavior change for templates whose substituted form already yields the expected argv; the existing quoted %s example retains its exact command string.
• Templates without %s, including the normal platform browser commands, are unchanged.
• Invalid BROWSER template syntax still fails as before.
• No breaking change is intended.