Fix HackerOne -3045235 by disabling the hyperlink - #6140
Open
sandboxcoder wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Streamlabs Desktop’s embedded GPLv3 text in top-level license documents to remove angle brackets around the FSF URL, aiming to prevent the URL from being rendered as a hyperlink.
Changes:
- Updated the FSF copyright line in
LICENSEto remove<...>around the FSF URL. - Updated the same line in
BASEAGREEMENTto match.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| LICENSE | Removes angle brackets around the FSF URL in the GPLv3 header text. |
| BASEAGREEMENT | Mirrors the same GPLv3 header text change in the embedded agreement copy. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
BundleMonUnchanged files (4)
No change in files bundle size Final result: ✅ View report in BundleMon website ➡️ |
sandboxcoder
force-pushed
the
rno/H1-3045235
branch
from
August 27, 2026 21:57
75af6f9 to
5caa2b3
Compare
sandboxcoder
force-pushed
the
rno/H1-3045235
branch
from
August 27, 2026 22:16
dfa6422 to
88ddf17
Compare
sandboxcoder
marked this pull request as ready for review
August 27, 2026 22:18
Comment on lines
+3
to
+7
| ; Disable auto-URL detection on the license page RichEdit control so that | ||
| ; URLs in the license text are displayed as plain text, not clickable links. | ||
| ; MUI_PAGE_CUSTOMFUNCTION_SHOW is scoped to the license page only: it is | ||
| ; undefined after the license page insertmacro (inserted by electron-builder) | ||
| ; to prevent it leaking into subsequent page definitions. |
Contributor
Author
There was a problem hiding this comment.
Updated PR description thanks
Comment on lines
+14
to
+16
| ${If} $0 != 0 | ||
| System::Call 'user32::SendMessage(i $0, i 0x45B, i 0, i 0)' | ||
| ${EndIf} |
michelinewu
approved these changes
Aug 28, 2026
sandboxcoder
marked this pull request as draft
August 28, 2026 15:21
sandboxcoder
changed the title
- fix https://app.asana.com/1/1083097041131/project/1209632301705219/task/1210265116004123 The installer runs elevated (nsis.perMachine = true -> RequestExecutionLevel admin), and NSIS's license page turns URLs in the licence text into live hyperlinks -- including the GPLv3 header's <https://fsf.org/>. NSIS opens them with a plain ShellExecute, so the browser inherits the installer's Administrator token. Remove the link rather than the URL: the GPL text is not ours to edit ("changing it is not allowed"). DisableLicenseLinks now clears ENM_LINK from the RichEdit's event mask. That is the actual kill switch -- NSIS opens URLs in response to the EN_LINK notification, so a control that never sends it can never trigger the ShellExecute. It also turns off EM_AUTOURLDETECT and strips CFE_LINK across the document so the text stops looking clickable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
sandboxcoder
force-pushed
the
rno/H1-3045235
branch
from
August 28, 2026 19:40
88ddf17 to
61ead96
Compare
sandboxcoder
changed the title
sandboxcoder
marked this pull request as ready for review
August 28, 2026 19:44
michelinewu
approved these changes
Aug 28, 2026
| Push $0 | ||
| Push $1 | ||
| Push $2 | ||
| ; The licence RichEdit (id 1000) is on the inner dialog (class #32770), a child of |
Contributor
Author
There was a problem hiding this comment.
good catch, thanks. Fixed commit 8e76a41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The installer runs elevated (nsis.perMachine = true -> RequestExecutionLevel
admin), and NSIS's license page turns URLs in the licence text into live
hyperlinks -- including the GPLv3 header's https://fsf.org/. NSIS opens them
with a plain ShellExecute, so the browser inherits the installer's Administrator
token.
Remove the link rather than the URL: the GPL text is not ours to edit
("changing it is not allowed").
DisableLicenseLinks now clears ENM_LINK from the RichEdit's event mask. That is
the actual kill switch -- NSIS opens URLs in response to the EN_LINK
notification, so a control that never sends it can never trigger the
ShellExecute. It also turns off EM_AUTOURLDETECT and strips CFE_LINK across the
document so the text stops looking clickable.
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Below is image, user can no longer click on the URL:
