FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-143930: Reject leading dashes in webbrowser URLs by sethmlarson · Pull Request #143931 · python/cpython · GitHub

/ cpython Public

gh-143930: Reject leading dashes in webbrowser URLs - #143931

Merged
sethmlarson merged 1 commit into
python:mainfrom
sethmlarson:reject-leading-dash-webbrowser-open
Mar 20, 2026
Merged

gh-143930: Reject leading dashes in webbrowser URLs#143931
sethmlarson merged 1 commit into
python:mainfrom
sethmlarson:reject-leading-dash-webbrowser-open

Conversation

sethmlarson commented Jan 16, 2026
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

sethmlarson requested a review from gpshead January 16, 2026 18:06
sethmlarson added type-security A security issue needs backport to 3.10 only security fixes stdlib Standard Library Python modules in the Lib/ directory needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 16, 2026

Yhg1s commented Jan 19, 2026

Copy link
Copy Markdown
Member

What about / or other common option prefixes?

Copy link
Copy Markdown
Contributor Author

@Yhg1s I'm concerned that there are use-cases for calling webbrowser.open() on paths, so we'd have to be more cautious in this case. Another option I suggested was to percent-encode spaces?

gpshead commented Jan 24, 2026

Copy link
Copy Markdown
Member

on windows a '/' prefix is typically a command line flag - does it actually work as an absolute current drive path on edge/chrome/firefox? to be a url for that it really should be "file://"

Copy link
Copy Markdown
Contributor Author

Yeah we currently support opening absolute paths via /index.html as a URL. Maybe we want to deprecate this in favor of forcing folks to use file:// but doing so here would result in breakages most likely. Let's move forward with only leading dashes for now.

sethmlarson merged commit 82a24a4 into python:main Mar 20, 2026
67 checks passed

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

sethmlarson deleted the reject-leading-dash-webbrowser-open branch March 20, 2026 14:47

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.12

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.11

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.10

bedevere-app Bot commented Mar 24, 2026

Copy link
Copy Markdown

GH-146364 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Mar 24, 2026

bedevere-app Bot commented Mar 24, 2026

Copy link
Copy Markdown

GH-146364 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot commented Mar 24, 2026

Copy link
Copy Markdown

GH-146359 is a backport of this pull request to the 3.10 branch.

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stdlib Standard Library Python modules in the Lib/ directory type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants


Back | FazBrowse Home | New Git URL