`PlatformOpenURL`'s 1500-char Wine guard is far too conservative on modern Wine (measured limit: 32676), and failures are silent

[Lowtrixx]

Summary

PlatformOpenURL (added in #70) refuses any URL longer than 1500 bytes when running under Wine on Linux/macOS:

// engine/system/win/sys_main.cpp
if ((wineHost == "Linux" || wineHost == "Darwin") && strlen(url) > 1500)
    return AllocString("Did not open URL, length likely too long for the OS.");

On current Wine this threshold is about 21x too strict, and because no Lua caller inspects the returned string, the user sees nothing at all — the button appears dead.

Impact

Most visible in the timeless jewel search (Classes/TreeTab.lua, "Open Next Trade URL"). A search over ~11 seeds produces a trade URL of ~1800 characters, which is silently dropped. The following line, Copy(url), still runs, so the URL lands on the clipboard with no indication that the browser was never invoked.

Measurements

Environment: Arch Linux (kernel 6.18), Wine 11.13 (64-bit prefix), Hyprland/Wayland, xdg-open -> Brave.

Test binary calling exactly what PlatformOpenURL calls — ShellExecuteA(NULL, "open", url, NULL, NULL, SW_SHOWDEFAULT) — with a stub xdg-open on PATH to record the URL actually delivered:

URL length	Result
1823 (real trade URL)	delivered, browser opened
4000 / 8000 / 16000 / 30000	delivered, browser opened
32676	delivered — last working length
32677	fails: err:environ:build_command_line command line too long

The cliff is the Windows 32767-char command-line limit, minus ~91 chars of overhead for "C:\windows\system32\winebrowser.exe" "<url>". It is not a crash: ShellExecuteA still returns 33, the child is simply never created — so the failure is silent at the API level too.

Note that the effective headroom depends on the length of the registered http\shell\open\command, so a fixed limit somewhat below 32767 is still reasonable.

One genuine long-URL crash does exist on this Wine version, but on a different path: wine start <url> segfaults (c0000005) above roughly 300 chars. ShellExecuteA is unaffected. If #70's original crash report came from a start.exe-based launcher, that would explain the very low bound chosen at the time.

Suggested fix

1. Raise the limit to something near the real constraint (e.g. 32000), or compute it as 32767 - strlen(handler command).
2. Surface the failure. Since no caller checks the return value today, either log it via ConPrintf inside PlatformOpenURL, or have callers such as TreeTab.lua:2173 show the message when a non-nil string comes back. As-is, a user on Linux gets a button that does nothing with no diagnostic.

Happy to open a PR for either part.

Workaround for other Linux users

The full URL is still copied to the clipboard by TreeTab.lua:2174, so pasting it manually works. Selecting a smaller row range before pressing the button also keeps the URL under 1500.

[Lowtrixx]

Follow-up: I went looking for evidence behind the two premises in #70 ("ShellExecute on Wine can crash if you feed it a too long URL", "some browsers have been documented to have a fairly low max limit of 2083 characters"). Neither holds on current Wine or current browsers, and I think the crash was misattributed.

1. ShellExecute does not crash — the crash is in start.exe

dlls/shell32/shlexec.c sizes its buffers dynamically:

len = lstrlenW(sei_tmp.lpParameters) + 1;
if (len > parametersLen)
{
    wszParameters = malloc(len * sizeof(WCHAR));
    parametersLen = len;
}

and uses wcsncpy_s(..., _TRUNCATE), returning ERROR_FILE_NOT_FOUND rather than overflowing.

There is a real long-argument crash in Wine, but on a different path. wine start <url> faults reliably:

err:seh:NtRaiseException Unhandled exception code c0000005 flags 0 addr 0x14000270b

Module map from that same run: start.exe at 0x140000000, shell32.dll at 0x6ffffc4c0000 — so the fault is start.exe+0x270b, not shell32. The cause is programs/start/start.c, search_path():

WCHAR stemofsearch[MAX_PATH];
...
lstrcpyW(stemofsearch, firstParam);   // unbounded on this branch

with file taken from argv without length validation. Measured crash threshold: between 283 and 303 characters — i.e. MAX_PATH, not 2048. Any launcher shelling out through start would hit this, which may be where the original report came from.

2. Measurements for ShellExecuteA specifically

Arch Linux, kernel 6.18, Wine 11.13, 64-bit prefix, Hyprland/Wayland, xdg-open -> Brave. Test binary calling exactly what PlatformOpenURL calls — ShellExecuteA(NULL, "open", url, NULL, NULL, SW_SHOWDEFAULT) — with a stub xdg-open early on PATH recording the URL actually delivered:

URL length	ShellExecuteA return	delivered to handler
2050	33	yes
2085	33	yes
3001	33	yes
5001	33	yes
12001	33	yes
25001	33	yes
32676	33	yes — last working length
32677+	33	no: err:environ:build_command_line command line too long

No crash at any length. The cliff is the Windows 32767-char command-line limit minus ~91 chars for "C:\windows\system32\winebrowser.exe" "<url>", and it fails silently rather than faulting (note ShellExecuteA still returns 33 there, so the return value can't be used to detect it).

3. The 2083 figure is Internet Explorer

Chromium, url/url_constants.h:

inline constexpr size_t kMaxURLChars = 2 * 1024 * 1024;  // 2 MB

End-to-end check with no external traffic: local HTTP server on 127.0.0.1:8731, 20025-char URL sent through ShellExecuteA -> real xdg-open -> Brave. The server logged a request path of 20004 characters — the browser accepted, navigated, and fetched it.

One caveat in the other direction: server-side header limits are real (nginx's default large_client_header_buffers is 8k), so a multi-kilobyte trade URL could still come back as a 4xx from the remote end. That's a remote response, not a client crash, and it doesn't justify a 1500-byte client-side guard.

Conclusion

On modern Wine the safe bound for ShellExecuteA is roughly 32767 - strlen(registered handler command), not 1500. Suggested change stands: raise the limit (32000 is safe with headroom, or compute it from the handler command length), and surface the returned message — today no Lua caller inspects it, so the failure is entirely invisible to the user.

[Nightblade]

I'm curious, is this from an LLM? Which one?

[Lowtrixx]

its from claude it also edit the file for me but it prob breaks after each update