FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.13] gh-143930: Reject leading dashes in webbrowser URLs by miss-islington · Pull Request #146215 · python/cpython · GitHub

/ cpython Public

[3.13] gh-143930: Reject leading dashes in webbrowser URLs #146215

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambv merged 1 commit into from
Mar 23, 2026
Conversation 0 Commits 1 Checks 41 Files changed
Merged

[3.13] gh-143930: Reject leading dashes in webbrowser URLs #146215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension .py  (2) .rst  (1) All 2 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
5 changes: 5 additions & 0 deletions Lib/test/test_webbrowser.py
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,11 @@ def test_open(self):
options=[],
arguments=[URL])

def test_reject_dash_prefixes(self):
browser = self.browser_class(name=CMD_NAME)
with self.assertRaises(ValueError):
browser.open(f"--key=val {URL}")


class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):

Expand Down
13 changes: 13 additions & 0 deletions Lib/webbrowser.py
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,12 @@ def open_new(self, url):
def open_new_tab(self, url):
return self.open(url, 2)

@staticmethod
def _check_url(url):
"""Ensures that the URL is safe to pass to subprocesses as a parameter"""
if url and url.lstrip().startswith("-"):
raise ValueError(f"Invalid URL: {url}")


class GenericBrowser(BaseBrowser):
"""Class for all browsers started with a command
Expand All @@ -181,6 +187,7 @@ def __init__(self, name):

def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
try:
Expand All @@ -201,6 +208,7 @@ def open(self, url, new=0, autoraise=True):
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
sys.audit("webbrowser.open", url)
self._check_url(url)
try:
if sys.platform[:3] == 'win':
p = subprocess.Popen(cmdline)
Expand Down Expand Up @@ -267,6 +275,7 @@ def _invoke(self, args, remote, autoraise, url=None):

def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
if new == 0:
action = self.remote_action
elif new == 1:
Expand Down Expand Up @@ -358,6 +367,7 @@ class Konqueror(BaseBrowser):

def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
# XXX Currently I know no way to prevent KFM from opening a new win.
if new == 2:
action = "newTab"
Expand Down Expand Up @@ -576,6 +586,7 @@ def register_standard_browsers():
class WindowsDefault(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
try:
os.startfile(url)
except OSError:
Expand All @@ -596,6 +607,7 @@ def __init__(self, name='default'):

def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
url = url.replace('"', '%22')
if self.name == 'default':
script = f'open location "{url}"' # opens in default browser
Expand Down Expand Up @@ -627,6 +639,7 @@ def open(self, url, new=0, autoraise=True):
class IOSBrowser(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
self._check_url(url)
# If ctypes isn't available, we can't open a browser
if objc is None:
return False
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Reject leading dashes in URLs passed to :func:`webbrowser.open`
Loading
Back | FazBrowse Home | New Git URL