Function openBrowser

src/auth/oauth.ts:124–134

* Open `url` in the user's default browser without going through a shell. * Using execFile/spawn (not exec) avoids shell-injection via crafted URLs (#79).

(url: string)

 * Using execFile/spawn (not exec) avoids shell-injection via crafted URLs (#79).
 */
function openBrowser(url: string): void {
  // eslint-disable-next-line @typescript-eslint/no-require-imports
  const { execFile, spawn } = require('child_process') as typeof import('child_process');
  if (process.platform === 'darwin') {
    execFile('open', [url]);
  } else if (process.platform === 'win32') {
    spawn('cmd.exe', ['/c', 'start', '', url], { shell: false, detached: true });
  } else {
    execFile('xdg-open', [url]);
  }
}