From 3eaf1d8865cf69f05920ba2e2ae8864eb700c012 Mon Sep 17 00:00:00 2001
From: nebulazorua <12458328+nebulazorua@users.noreply.github.com>
Date: Thu, 17 Apr 2025 08:21:41 +0800
Subject: [PATCH 1/2] vuln patch p2

---
 flixel/FlxG.hx | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/flixel/FlxG.hx b/flixel/FlxG.hx
index 8da349830d..86a31fa424 100644
--- a/flixel/FlxG.hx
+++ b/flixel/FlxG.hx
@@ -517,9 +517,11 @@ class FlxG
 	 */
 	public static inline function openURL(url:String, target = "_blank"):Void
 	{
-		// if the url does not already start with a protocol, add it.
-		if (!~/^.\w+?:\/*/.match(url))
-			url = "https://" + url;
+	    // Ensure you can't open protocols such as steam://, file://, etc
+	    var protocol:Array<String> = url.split("://");
+	    if (protocol.length == 1) url = 'https://${targetUrl}';
+	    else if (protocol[0] != 'http' && protocol[0] != 'https') throw "openURL can only open http and https links.";
+			
 		Lib.getURL(new URLRequest(url), target);
 	}
 

From d27f372b4d15328e33c0b21811192b0937853a7e Mon Sep 17 00:00:00 2001
From: Furo <furogaming9@gmail.com>
Date: Mon, 22 Sep 2025 19:30:00 +0200
Subject: [PATCH 2/2] Fixes FlxBar graphic being destoyed crashing the game

---
 flixel/ui/FlxBar.hx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flixel/ui/FlxBar.hx b/flixel/ui/FlxBar.hx
index dcc0ac13d1..38cc820949 100644
--- a/flixel/ui/FlxBar.hx
+++ b/flixel/ui/FlxBar.hx
@@ -993,10 +993,10 @@ class FlxBar extends FlxSprite
 	{
 		if (FlxG.renderTile)
 		{
-			if (value != null)
+			if (value != null && value.parent != null)
 				value.parent.incrementUseCount();
 				
-			if (frontFrames != null)
+			if (frontFrames != null && frontFrames.parent != null)
 				frontFrames.parent.decrementUseCount();
 
 			frontFrames = value;