File CVE-2026-4519-webbrowser-open-dashes.patch of Package python312
From d498b7e55b603ef9c80508ed8eb9556a1156f49e Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 20 Mar 2026 09:47:13 -0500
Subject: [PATCH 1/2] gh-143930: Reject leading dashes in webbrowser URLs
(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
---
Lib/test/test_webbrowser.py | 5 ++++
Lib/webbrowser.py | 12 ++++++++++
Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst | 1
3 files changed, 18 insertions(+)
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
Index: Python-3.12.13/Lib/test/test_webbrowser.py
===================================================================
--- Python-3.12.13.orig/Lib/test/test_webbrowser.py 2026-03-27 20:07:52.032965514 +0100
+++ Python-3.12.13/Lib/test/test_webbrowser.py 2026-03-27 20:07:54.695959647 +0100
@@ -59,6 +59,11 @@
options=[],
arguments=[URL])
+ def test_reject_dash_prefixes(self):
+ browser = self.browser_class(name=CMD_NAME)
+ with self.assertRaises(ValueError):
+ browser.open(f"--key=val {URL}")
+
class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
Index: Python-3.12.13/Lib/webbrowser.py
===================================================================
--- Python-3.12.13.orig/Lib/webbrowser.py 2026-03-27 20:07:52.424551572 +0100
+++ Python-3.12.13/Lib/webbrowser.py 2026-03-27 20:07:54.697002945 +0100
@@ -157,6 +157,12 @@
def open_new_tab(self, url):
return self.open(url, 2)
+ @staticmethod
+ def _check_url(url):
+ """Ensures that the URL is safe to pass to subprocesses as a parameter"""
+ if url and url.lstrip().startswith("-"):
+ raise ValueError(f"Invalid URL: {url}")
+
class GenericBrowser(BaseBrowser):
"""Class for all browsers started with a command
@@ -174,6 +180,7 @@
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
try:
@@ -194,6 +201,7 @@
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
sys.audit("webbrowser.open", url)
+ self._check_url(url)
try:
if sys.platform[:3] == 'win':
p = subprocess.Popen(cmdline)
@@ -259,6 +267,7 @@
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
if new == 0:
action = self.remote_action
elif new == 1:
@@ -349,6 +358,7 @@
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
# XXX Currently I know no way to prevent KFM from opening a new win.
if new == 2:
action = "newTab"
@@ -553,6 +563,7 @@
class WindowsDefault(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
try:
os.startfile(url)
except OSError:
@@ -637,6 +648,7 @@
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
if self.name == 'default':
script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
else:
Index: Python-3.12.13/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.12.13/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst 2026-03-27 20:07:54.696345345 +0100
@@ -0,0 +1 @@
+Reject leading dashes in URLs passed to :func:`webbrowser.open`
