CNA-GAP-057: CNA::Devices host dialogs are minimal: message boxes are unparented with no default or cancel button, tray icons have no image API, and UrlLauncher passes any string to the OS

CNA snapshot 009d40f5  ·  Known Issues › Functional gaps  ·  source links pinned to 009d40f5

MessageBox passes a null parent window and SDL buttons without RETURNKEY/ESCAPEKEY defaults, SystemTray offers only a tooltip and menu, and UrlLauncher::Open forwards its argument unvalidated to the platform (ShellExecuteW 'open' on Win32).

Identifier

CNA-GAP-057

Category

Functional gap

Subsystem

Platforms

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

Yes: see Current tests

Affected contract

CNA::Devices::MessageBox::Show, CNA::Devices::SystemTray, CNA::Devices::UrlLauncher::Open

Expected behaviour

Desktop message boxes are usually modal to the game window, with Enter and Escape mapped to default and cancel buttons; tray icons usually carry an application image; a URL launcher usually restricts itself to URL schemes.

Actual behaviour at TARGET

MessageBox.cpp passes nullptr as the parent to ShowMessageBox, and the SDL3 implementation in Sdl3SystemServices.cpp sets button.flags = 0 on every button. SystemTray.hpp has no icon-image member. UrlLauncher.cpp forwards the string to IPlatformSystemInfo::OpenUrl; on Win32 that is ShellExecuteW(nullptr, L"open", ...), which also opens local paths and executables. UrlLauncher.hpp asks for “A valid URL/URI” but CNA does not check it.

Source locations

• modules/devices-ext/src/MessageBox.cpp — null parent window
• modules/platform/src/Sdl3/Sdl3SystemServices.cpp — ShowMessageBox: button.flags = 0
• modules/devices-ext/include/CNA/Devices/SystemTray.hpp — tooltip and menu only
• modules/devices-ext/src/UrlLauncher.cpp — UrlLauncher::Open forwards unvalidated
• modules/platform/src/Win32/Win32SystemServices.cpp — Win32SystemInfo::OpenUrl: ShellExecuteW open

Evidence

Checked by reading at 009d40f5; not executed.

Focused reproduction

No focused reproduction is known. Nothing has been invented here; the evidence above is what exists.

Current tests

devices-ext tests use canned platforms (MessageBoxTests.cpp, SystemTrayTests.cpp, UrlLauncherTests.cpp).

Regression test

If added: a parent-window argument, default/cancel button flags, an icon API and a scheme allow-list, each with a canned-platform test.

Blast radius

Applications using these CNA extensions: dialogs can appear behind a fullscreen game and ignore Enter/Escape; untrusted strings passed to UrlLauncher can launch local programs on Windows.

Workaround

Validate URLs (scheme allow-list) before calling UrlLauncher::Open.