Function validate

pkg/browser/browser.go:55–70

validate rejects inputs that are unsafe to hand to the platform "open" helper (open, xdg-open, rundll32). Those helpers receive the URL as a positional argument, so a value beginning with "-" would be parsed as a command-line flag rather than a URL (argument injection). This matters now that URLs ca

(raw string)

// "docker-desktop://" — since restricting to http(s) would defeat deep-link
// use cases.
func validate(raw string) error {
	if raw == "" {
		return errors.New("empty URL")
	}
	if strings.HasPrefix(raw, "-") {
		return fmt.Errorf("refusing to open URL that looks like a command-line flag: %q", raw)
	}
	u, err := url.Parse(raw)
	if err != nil {
		return fmt.Errorf("invalid URL %q: %w", raw, err)
	}
	if u.Scheme == "" {
		return fmt.Errorf("URL must include a scheme (e.g. https://): %q", raw)
	}
	return nil
}