GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-137586: Open external osascript program with absolute path by fionn · Pull Request #137584 · python/cpython

Conversation

@fionn

@fionn fionn commented Aug 9, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

On macOS, web browsers are opened via popen calling osascript. However, if a user has a colliding osascript executable earlier in their PATH, this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.

  • Issue: Use absolute paths when invoking built-in shell commands #137586

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added the awaiting review label Aug 9, 2025
@python-cla-bot

python-cla-bot Bot commented Aug 9, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.

CLA signed
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Aug 9, 2025

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
1 similar comment
@bedevere-app

bedevere-app Bot commented Aug 9, 2025

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Aug 9, 2025

Copy link
Copy Markdown
Member

Please open an issue first.
fionn reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@fionn fionn changed the title Open web browser with absolute path gh-137586: Open web browser with absolute path Aug 9, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Aug 9, 2025
Use absolute paths when invoking built-in shell commands #137586
Closed
@frenzymadness

frenzymadness commented Oct 7, 2025

Copy link
Copy Markdown
Contributor

Could you please add a news entry and also fix the osascript invocation in Lib/turtledemo/__main__.py?
fionn reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@fionn
fionn requested a review from terryjreedy as a code owner October 16, 2025 17:08
fionn added 3 commits October 17, 2025 01:09
@fionn
Open web browser with absolute path
2ef2289 
On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be
considered a security vulnerability.
@fionn
Invoke osascript with absolute path in turtledemo
882f3d6
@fionn
Add NEWS entry for osascript path
00682c5
@fionn

fionn commented Oct 16, 2025

Copy link
Copy Markdown
Contributor Author

Yes, done. I wasn't sure if this was significant enough to warrant a news item.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@secengjeff secengjeff mentioned this pull request Mar 26, 2026
gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser #146439
Merged
@secengjeff

secengjeff commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

#146439 takes a broader approach to this issue by replacing MacOSXOSAScript entirely with a new MacOSX class that uses /usr/bin/open via subprocess.run, rather than switching to /usr/bin/osascript. This eliminates the osascript dependency and the PATH-injection vector completely, and also addresses the related usability problem of webbrowser.open() failing silently on managed endpoints where osascript is blocked. It may be worth considering whether that PR supersedes this one.
fionn reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead
Merge branch 'main' into no-path-injection
7e51307
@gpshead gpshead added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes type-security A security issue needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 5, 2026
@gpshead

gpshead commented Apr 5, 2026

Copy link
Copy Markdown
Member

This is one think is worthwhile backporting given not relying on $PATH for this system binary seems like a good thing security wise.
merwok reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hugovk
hugovk reviewed Apr 6, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@hugovk

hugovk commented Apr 6, 2026

Copy link
Copy Markdown
Member

@fionn Please could you sign the CLA again?

#137584 (comment)

See https://devguide.python.org/getting-started/pull-request-lifecycle/#why-do-i-need-to-sign-the-cla-again
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@fionn @hugovk
Be more specific in news item
489d186 
Co-authored-by: Hugo van Kemenade <[email protected]>
@fionn

fionn commented Apr 6, 2026

Copy link
Copy Markdown
Contributor Author

Ah, I guess this happened because I accepted the suggestion via the GitHub UI, which added a commit with the GitHub email address.

I amended the commit to match the email address I signed the CLA with instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hugovk

hugovk commented Apr 6, 2026

Copy link
Copy Markdown
Member

Thanks, yes, that'll be it.

But you'll still need to add the GH account email to the CLA when the first backport PR is opened.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@merwok merwok changed the title gh-137586: Open web browser with absolute path gh-137586: Open external osascript program with absolute path Apr 6, 2026
gpshead
gpshead approved these changes Apr 6, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added the awaiting merge label Apr 6, 2026
@gpshead
gpshead merged commit a0c57a8 into python:main Apr 6, 2026
55 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

Thanks @fionn for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Apr 6, 2026
@bedevere-app

bedevere-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

GH-148173 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 6, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 6, 2026
@fionn @hugovk @miss-islington
pythongh-137586: Open external osascript program with absolute path (p…
dd0a3d9 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
(cherry picked from commit a0c57a8)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

GH-148174 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Apr 6, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 6, 2026
@fionn @hugovk @miss-islington
pythongh-137586: Open external osascript program with absolute path (p…
95d5085 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
(cherry picked from commit a0c57a8)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 6, 2026
@fionn @hugovk @miss-islington
pythongh-137586: Open external osascript program with absolute path (p…
e9e7c9c 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
(cherry picked from commit a0c57a8)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

GH-148175 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 6, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 6, 2026
@fionn @hugovk @miss-islington
pythongh-137586: Open external osascript program with absolute path (p…
7a6cb58 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
(cherry picked from commit a0c57a8)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

GH-148176 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 6, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 6, 2026
@fionn @hugovk @miss-islington
pythongh-137586: Open external osascript program with absolute path (p…
c53e2b5 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
(cherry picked from commit a0c57a8)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 6, 2026

Copy link
Copy Markdown

GH-148177 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Apr 6, 2026
@gpshead

gpshead commented Apr 6, 2026

Copy link
Copy Markdown
Member

But you'll still need to add the GH account email to the CLA when the first backport PR is opened.

confirming - #148173 (comment) - yup, looks like it needs the CLA as well. @fionn
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hugovk added a commit that referenced this pull request Apr 7, 2026
@miss-islington @fionn @hugovk
[3.14] gh-137586: Open external osascript program with absolute path (G…
8f59d40 
…H-137584) (#148173)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
hugovk added a commit that referenced this pull request Apr 7, 2026
@miss-islington @fionn @hugovk
[3.13] gh-137586: Open external osascript program with absolute path (G…
c358b89 
…H-137584) (#148174)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
hugovk added a commit that referenced this pull request Apr 7, 2026
@miss-islington @fionn @hugovk
[3.12] gh-137586: Open external osascript program with absolute path (G…
20b4393 
…H-137584) (#148175)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
hugovk added a commit that referenced this pull request Apr 7, 2026
@miss-islington @fionn @hugovk
[3.11] gh-137586: Open external osascript program with absolute path (G…
0ec71cd 
…H-137584) (#148176)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
hugovk added a commit that referenced this pull request Apr 7, 2026
@miss-islington @fionn @hugovk
[3.10] gh-137586: Open external osascript program with absolute path (G…
e70ff77 
…H-137584) (#148177)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
@fionn

fionn commented Apr 7, 2026

Copy link
Copy Markdown
Contributor Author

confirming - #148173 (comment) - yup, looks like it needs the CLA as well.

Strange! Have re-signed it.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@fionn
fionn deleted the no-path-injection branch April 7, 2026 03:36
@bedevere-bot

bedevere-bot commented Apr 7, 2026

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot PPC64LE Fedora Stable Clang Installed 3.13 (tier-3) has failed when building commit c358b89.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1429/builds/1122) and take a look at the build logs.
  4. Check if the failure is related to this commit (c358b89) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1429/builds/1122

Summary of the results of the build (if available):

Click to see traceback logs 
fatal: unable to access 'https://github.com/python/cpython.git/': Failed to connect to github.com port 443 after 890 ms: Could not connect to server

chmod: cannot access 'target/': No such file or directory

make: *** No rule to make target 'distclean'.  Stop.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
@fionn @hugovk @ljfp
pythongh-137586: Open external osascript program with absolute path (p…
42984a3 
…ythonGH-137584)

Open web browser with absolute path

On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be considered a security vulnerability.

Co-authored-by: Hugo van Kemenade <[email protected]>
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request Oct 28, 2026
@miss-islington @fionn
@hugovk @icanhasmath
[3.10] pythongh-137586: Open external osascript program with absolute…
37f0522 
… path (pythonGH-137584) (python#148177)

Co-authored-by: Fionn <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
(cherry picked from commit e70ff77)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk hugovk left review comments
@gpshead gpshead gpshead approved these changes
@terryjreedy terryjreedy Awaiting requested review from terryjreedy terryjreedy is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@fionn @picnixz @frenzymadness @secengjeff @gpshead @hugovk @bedevere-bot
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.