fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in command, not an executable

Author: karpierz

src/click/_termui_impl.py

@@ -697,6 +697,7 @@ def _unquote_file(url: str) -> str:
         finally:
             null.close()
     elif WIN:
+        shell = False
         if locate:
             url = _unquote_file(url)
             args = ["explorer", f"/select,{url}"]
@@ -706,8 +707,9 @@ def _unquote_file(url: str) -> str:
                 args.append("/WAIT")
             args.append("")
             args.append(url)
+            shell = True
         try:
-            return subprocess.call(args)
+            return subprocess.call(args, shell=shell)
         except OSError:
             # Command not found
             return 127