Windows remote: Opening URL via $BROWSER can run arbitrary code

• VSCode Version: 1.115.0 (Universal)
• Local OS Version: macOS Sequoia (Darwin arm64 24.6.0)
• Remote OS Version: Windows 11
• Remote Extension/Connection Type: VS Code Server via SSH (yes, I think this is a Server issue, not SSH)

VSCode remote for Windows will set the BROWSER environment var with a wrapper to open the local machine's browser instead. This is a batch script, which doesn't properly escape ampersands in the URL. Extra query args may be interpreted as commands and the shell tries to execute them.

Steps to Reproduce:

1. Connect to a Windows machine using a remote connection (I use SSH) and open a terminal
2. python -c "import webbrowser; webbrowser.open('https://www.example.com/?query=1&calc.exe')"
3. Notice that the calculator is opened on the remote machine

Does this issue occur when you try this locally?:No, $BROWSER is not modified.

Start with resources/server/bin/helpers/browser.cmd, which sets the Windows remote BROWSER wrapper, and inspect how the URL is passed to the shell. Reproduce with the provided Python command and verify that the query string is treated only as a URL, without opening calc.exe on the remote machine.