GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-143930: Reject leading dashes in webbrowser URLs by sethmlarson · Pull Request #143931 · python/cpython

Conversation

sethmlarson commented Jan 16, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Issue: Reject leading dashes in webbrowser.open() #143930

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          pythongh-143930: Reject leading dashes in webbrowser URLs

b0fa074

sethmlarson requested a review from gpshead

January 16, 2026 18:06

sethmlarson added type-security

A security issue

needs backport to 3.10 stdlib

Standard Library Python modules in the Lib/ directory

needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14 bugs and security fixes labels

Jan 16, 2026

bedevere-app Bot mentioned this pull request

Jan 16, 2026

Reject leading dashes in webbrowser.open() #143930

Closed

bedevere-app Bot added the awaiting review label

Jan 16, 2026

Yhg1s commented Jan 19, 2026

Copy link

Copy Markdown

Member

What about / or other common option prefixes?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson commented Jan 19, 2026

Copy link

Copy Markdown

Contributor Author

@Yhg1s I'm concerned that there are use-cases for calling webbrowser.open() on paths, so we'd have to be more cautious in this case. Another option I suggested was to percent-encode spaces?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead approved these changes

Jan 24, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels

Jan 24, 2026

gpshead commented Jan 24, 2026

Copy link

Copy Markdown

Member

on windows a '/' prefix is typically a command line flag - does it actually work as an absolute current drive path on edge/chrome/firefox? to be a url for that it really should be "file://"

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson commented Mar 20, 2026

Copy link

Copy Markdown

Contributor Author

Yeah we currently support opening absolute paths via /index.html as a URL. Maybe we want to deprecate this in favor of forcing folks to use file:// but doing so here would result in breakages most likely. Let's move forward with only leading dashes for now.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson merged commit 82a24a4 into python:main

Mar 20, 2026

67 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Mar 20, 2026

miss-islington-app Bot commented Mar 20, 2026

Copy link

Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson deleted the reject-leading-dash-webbrowser-open branch

March 20, 2026 14:47

miss-islington-app Bot commented Mar 20, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.12

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned sethmlarson

Mar 20, 2026

miss-islington-app Bot commented Mar 20, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Mar 20, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.10

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot commented Mar 24, 2026

Copy link

Copy Markdown

GH-146364 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Mar 24, 2026

bedevere-app Bot commented Mar 24, 2026

Copy link

Copy Markdown

GH-146364 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot commented Mar 24, 2026

Copy link

Copy Markdown

GH-146359 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

github-actions Bot mentioned this pull request

Sep 28, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#18780

Closed

This was referenced Oct 5, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#19389

Closed

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#19404

Closed

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#19417

Closed

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#19431

Closed

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#19481

Closed

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#19490

Closed

This was referenced Oct 12, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#20147

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#20154

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#20167

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#20172

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#20181

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#20195

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#20654

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#20662

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#20671

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#20680

Open

This was referenced Oct 26, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#21128

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#21147

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#21157

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#21174

Open

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.10] pythongh-143930: Reject leading dashes in webbrowser URLs (pyt…

58011bd

…honGH-143931) (pythonGH-146359)

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <[email protected]>
(cherry picked from commit ad4d5ba)

This was referenced Nov 2, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#21625

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#21641

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#21642

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#21660

Open

This was referenced Nov 9, 2026

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#22125

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267 RADAR-base/radar-helm-charts#22128

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#22144

Open

Arbitrary Argument Injection SNYK-RHEL9-PYTHON3LIBS-15760285 RADAR-base/radar-helm-charts#22146

Open

Reviewers

gpshead

gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

sethmlarson

Labels

stdlib

Standard Library Python modules in the Lib/ directory

type-security

A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

sethmlarson commented Jan 16, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Yhg1s commented Jan 19, 2026

Uh oh!

sethmlarson commented Jan 19, 2026

Uh oh!

gpshead commented Jan 24, 2026

Uh oh!

sethmlarson commented Mar 20, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Mar 20, 2026

Uh oh!

miss-islington-app Bot commented Mar 20, 2026

Uh oh!

miss-islington-app Bot commented Mar 20, 2026

Uh oh!

miss-islington-app Bot commented Mar 20, 2026

Uh oh!

bedevere-app Bot commented Mar 24, 2026

Uh oh!

bedevere-app Bot commented Mar 24, 2026

Uh oh!

bedevere-app Bot commented Mar 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sethmlarson commented Jan 16, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.