docs(nesdoctor): a live URL in a comment is a URL something will follow

The comment explaining the `cmd /C start` bug spelled out the cut submit
link in full. This repository is public and is pull-mirrored onto forges
that crawlers index far more eagerly than GitHub does, so GPTBot found it
there and followed it -- twice. The worker classed both as truncated
submissions, correctly, and raised an alert apiece for a bug fixed in
0.2.1.

Describe the cut URL instead of writing it, and say why, so the next
person documenting a bad link does not paste a working one.
This commit is contained in:
Wanjohi
2026-09-19 20:23:34 +03:00
parent a09ad1e09a
commit 3482ed6788

View File

@@ -710,13 +710,20 @@ pub fn open_in_browser(url: &str) -> bool {
// and treats `&` as a command separator; Rust's `Command` quotes arguments
// for the MSVC C runtime convention, which `cmd` does not honour. So a URL
// is cut at its first `&` -- which in ours falls immediately after `v=` --
// and the browser opened `https://doctor.nestri.io/?v=0.2.0` carrying
// nothing else at all.
// and the browser opened the submit URL bearing a version and nothing
// else at all.
//
// Silently, too: the worker saw a version, accepted it, and thanked the
// person for a submission that contained one field. Two arrived like that
// before anyone noticed.
//
// That cut URL is deliberately not written out here. This repository is
// public and gets pull-mirrored onto forges that crawlers index far more
// eagerly than GitHub does, so a working link in a comment is a link
// something will eventually follow: two such visits reached the worker,
// were correctly classed as truncated submissions, and raised an alert
// apiece for a bug that had been fixed for weeks.
//
// `rundll32 url.dll,FileProtocolHandler` hands the URL to the shell's
// protocol handler without any command interpreter in the path, so nothing
// re-parses it. `explorer.exe` also works and returns a non-zero exit