🛡️ Sentinel: Fix Email Content Injection in mailto links (#2141)

🛡️ Sentinel: [MEDIUM] Fix Email Content Injection

🚨 Severity: MEDIUM
💡 Vulnerability: Email Content Injection in `mailto` links.
🎯 Impact: An attacker could inject unintended headers (like CC, BCC) or
modify the body/subject if the input (e.g., subject) contained special
characters like `&` or `=`.
🔧 Fix: Use `encodeQueryParameters` method, which automatically and
correctly handles percent-encoding of query parameters.
✅ Verification: Added
`lib/url_launcher_extended/test/url_launcher_extended_test.dart` which
tries to inject a `cc` parameter via the `subject` field and asserts
that it is correctly encoded as part of the subject rather than
interpreted as a new parameter.

---
*PR created automatically by Jules for task
[3007356946123536916](https://jules.google.com/task/3007356946123536916)
started by @nilsreichardt*

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: nilsreichardt <24459435+nilsreichardt@users.noreply.github.com>

Author: nilsreichardt

lib/url_launcher_extended/lib/src/url_launcher_extended.dart

@@ -88,6 +88,20 @@ class UrlLauncherExtended {
     return url_launcher.canLaunchUrl(url);
   }
 
+  /// Encodes the given parameters into a query string.
+  ///
+  /// [Uri.queryParameters] constructor should be avoid due to [a
+  /// bug](https://github.com/dart-lang/sdk/issues/43838) in Dart. See
+  /// https://pub.dev/packages/url_launcher#encoding-urls.
+  String? _encodeQueryParameters(Map<String, String> params) {
+    return params.entries
+        .map(
+          (entry) =>
+              '${Uri.encodeComponent(entry.key)}=${Uri.encodeComponent(entry.value)}',
+        )
+        .join('&');
+  }
+
   /// Create email draft to the default email app by converting the parameters
   /// into an uri, like
   /// "mailto:smith@example.com?subject=Example+Subject+%26+Symbols+are+allowed%21"
@@ -107,16 +121,15 @@ class UrlLauncherExtended {
     String? subject,
     String? body,
   }) async {
-    String url = 'mailto:$address';
-    if (subject != null) {
-      url += '?subject=$subject';
-    }
-    if (body != null) {
-      url += subject == null ? '?' : '&';
-      url += 'body=$body';
-    }
+    final uri = Uri(
+      scheme: 'mailto',
+      path: address,
+      query: _encodeQueryParameters({
+        if (subject != null) 'subject': subject,
+        if (body != null) 'body': body,
+      }),
+    );
 
-    final uri = Uri.parse(url);
     final canLaunch = await canLaunchUrl(uri);
     if (!canLaunch) {
       throw CouldNotLaunchMailException(address, subject: subject, body: body);

lib/url_launcher_extended/test/url_launcher_extended_test.dart

@@ -0,0 +1,95 @@
+// Copyright (c) 2026 Sharezone UG (haftungsbeschränkt)
+// Licensed under the EUPL-1.2-or-later.
+//
+// You may obtain a copy of the Licence at:
+// https://joinup.ec.europa.eu/software/page/eupl
+//
+// SPDX-License-Identifier: EUPL-1.2
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:url_launcher_extended/src/url_launcher_extended.dart';
+import 'package:url_launcher/url_launcher.dart';
+
+class TestUrlLauncherExtended extends UrlLauncherExtended {
+  Uri? lastLaunchedUri;
+
+  @override
+  Future<bool> launchUrl(
+    Uri url, {
+    LaunchMode mode = LaunchMode.platformDefault,
+    WebViewConfiguration webViewConfiguration = const WebViewConfiguration(),
+    String? webOnlyWindowName,
+  }) async {
+    lastLaunchedUri = url;
+    return true;
+  }
+
+  @override
+  Future<bool> canLaunchUrl(Uri url) async {
+    return true;
+  }
+}
+
+void main() {
+  test('Security: prevents parameter injection in mailto links', () async {
+    final launcher = TestUrlLauncherExtended();
+
+    // Malicious subject attempting to inject a CC header
+    const subject = 'Hello&cc=hacker@example.com';
+
+    await launcher.tryLaunchMailOrThrow(
+      'user@example.com',
+      subject: subject,
+      body: 'Body',
+    );
+
+    final uri = launcher.lastLaunchedUri!;
+
+    // The injected parameters should NOT be parsed as separate query keys.
+    expect(
+      uri.queryParameters.containsKey('cc'),
+      isFalse,
+      reason: 'CC parameter was injected',
+    );
+
+    // The subject should contain the full string (properly encoded in the URI string)
+    expect(uri.queryParameters['subject'], equals(subject));
+
+    // Verify string representation contains encoded characters
+    // & should be %26, = should be %3D
+    expect(
+      uri.toString(),
+      contains('subject=Hello%26cc%3Dhacker%40example.com'),
+    );
+  });
+
+  test('Normal usage with body & subject works correctly', () async {
+    final launcher = TestUrlLauncherExtended();
+
+    await launcher.tryLaunchMailOrThrow(
+      'user@example.com',
+      subject: 'Hello World',
+      body: 'This is a body',
+    );
+
+    final uri = launcher.lastLaunchedUri!;
+
+    expect(uri.scheme, equals('mailto'));
+    expect(uri.path, equals('user@example.com'));
+    expect(uri.queryParameters['subject'], equals('Hello World'));
+    expect(uri.queryParameters['body'], equals('This is a body'));
+  });
+
+  test('Normal usage with only subject works correctly', () async {
+    final launcher = TestUrlLauncherExtended();
+
+    await launcher.tryLaunchMailOrThrow('user@example.com');
+
+    final uri = launcher.lastLaunchedUri!;
+
+    expect(uri.scheme, equals('mailto'));
+    expect(uri.path, equals('user@example.com'));
+    expect(uri.queryParameters['subject'], isNull);
+    expect(uri.queryParameters['body'], isNull);
+  });
+}