More secure command line argument handling for a URL handler.

ssh-handler/ssh-handler.cs

@@ -42,27 +42,33 @@ public class SshHandler
         {
             Regex usage = new Regex(@"^(?:/|--?)(?:h|help|usage|\?)$", RegexOptions.IgnoreCase);
             Regex putty = new Regex(@"^(?:/|--?)putty(?:[:=](?<putty_path>.*))?$", RegexOptions.IgnoreCase);
-            Uri uri = null;
+            IList<string> uriParts = null;
 
             foreach (string arg in args)
-            {
+                if (uriParts == null)
-                if (usage.IsMatch(arg))
+                {
-                    return Usage(0);
+                    if (usage.IsMatch(arg))
+                        return Usage(0);
 
-                Match match;
+                    Match match;
 
-                if ((match = putty.Match(arg)).Success)
+                    if ((match = putty.Match(arg)).Success)
-                {
+                    {
-                    handler = Handler.Putty;
+                        handler = Handler.Putty;
-                    Group group = match.Groups["putty_path"];
+                        Group group = match.Groups["putty_path"];
-                    if (group.Success)
+                        if (group.Success)
-                        puttyPath = group.Value;
+                            puttyPath = group.Value;
+                    }
+                    else
+                        uriParts = new List<string>(new string[] { arg });
                 }
                 else
-                    uri = new Uri(arg, UriKind.Absolute);
+                    uriParts.Add(arg);
-            }
+
+            if (uriParts != null)
+            {
+                Uri uri = new Uri(string.Join(" ", uriParts), UriKind.Absolute);
 
-            if (uri != null)
                 switch (handler)
                 {
                     case Handler.Unspecified:
@@ -75,6 +81,7 @@ public class SshHandler
                         Putty(uri);
                         break;
                 }
+            }
             else
                 return Usage(1);
         }