Granted, on its own, this should be safe. But attacks are usually composed from multiple bugs and/or weaknesses in design. Hence why security folk keep talking about “defence in depth” — ie not to rely on the security of any single facet but instead layering your security just in case any one particular layer does prove to be insufficient.
This is why in my own terminal emulator I implemented hyperlinks via user defined RegEx. The terminal user gets to decide what text becomes click-actionable rather than the attacker.
I actually voiced some concerns with this original hyperlink proposal several years back. In fact lots of developers and security researchers did. And the gist authors response was to delete the replies and turn off comments. Which adds additional concern about this proposal. It follows no process, no feedback, nothing. Just one persons mission to dictate how everyone else’s terminal, and security model, should operate.
CORS has no relation to this issue. Cross-origin means there are at least two origins, but in this case there is only one (where you're trying to navigate).
> But if request is originating from inside the network (as it would from a terminal emulator)
Why would the terminal make requests? Obviously it will dispatch the link to another program specialized in making requests to a protocol, like... a browser?
> Granted, on its own, this should be safe. But attacks are usually composed from multiple bugs and/or weaknesses in design. Hence why security folk keep talking about “defence in depth”
Every feature can be part of an exploit chain, but the "clicking a URL will always lead to the text it is under" ship has sailed 30+ years ago. If your system cannot safely handle this operation then you're in deep trouble, and I don't see how crippling every program in existence is the right solution to that.
> I actually voiced some concerns with this original hyperlink proposal several years back. In fact lots of developers and security researchers did.
Based on what you've written: you and other self-claimed "security researchers" started spamming this spec with concern trolling about hypothetical (non-existent) "security issues", then the author finally got tired and locked down comments, which were obviously intended for people interested in the feature, not those trying to sabotage it.
> Just one persons mission to dictate how everyone else’s terminal, and security model, should operate.
Nowhere does the proposal say that your terminal has to implement this. Indeed, if you have a working ANSI parser the escape sequence is ignored automatically (as the spec also explains).
Have you considered that the person trying to dictate how others' terminals should operate might be you?
e.g. "Log in to receive your bitcoin: https://colnbase.com" (phishing)
