Merge pull request #4310 from Tyriar/4309

Improve explanation of danger with the linkHandler API

src/browser/OscLinkProvider.ts

@@ -94,7 +94,7 @@ export class OscLinkProvider implements ILinkProvider {
 }
 
 function defaultActivate(e: MouseEvent, uri: string): void {
-  const answer = confirm(`Do you want to navigate to ${uri}?`);
+  const answer = confirm(`Do you want to navigate to ${uri}?\n\nWARNING: This link could potentially be dangerous`);
   if (answer) {
     const newWindow = window.open();
     if (newWindow) {

typings/xterm.d.ts

@@ -129,9 +129,14 @@ declare module 'xterm' {
 
     /**
      * The handler for OSC 8 hyperlinks. Links will use the `confirm` browser
-     * API if no link handler is set. Consider the security of users when using
-     * this, there should be some tooltip or prompt when hovering or activating
-     * the link.
+     * API with a strongly worded warning if no link handler is set.
+     *
+     * When setting this, consider the security of users opening these links,
+     * at a minimum there should be a tooltip or a prompt when hovering or
+     * activating the link respectively. An example of what might be possible is
+     * a terminal app writing link in the form `javascript:...` that runs some
+     * javascript, a safe approach to prevent that is to validate the link
+     * starts with http(s)://.
      */
     linkHandler?: ILinkHandler | null;