GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.10] gh-143930: Reject leading dashes in webbrowser URLs (GH-143931) by tomcruiseqi · Pull Request #146359 · python/cpython

Conversation

@tomcruiseqi

@tomcruiseqi tomcruiseqi commented Mar 24, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

(cherry picked from commit 82a24a4)

  • Issue: Reject leading dashes in webbrowser.open() #143930

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Copilot AI review requested due to automatic review settings March 24, 2026 06:49
@bedevere-app bedevere-app Bot added the awaiting review label Mar 24, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Mar 24, 2026
Reject leading dashes in webbrowser.open() #143930
Closed
Copilot started reviewing on behalf of tomcruiseqi March 24, 2026 06:50
View session
Copilot AI reviewed Mar 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR backports a security hardening change to webbrowser to prevent option-injection style issues by rejecting URLs that begin with - (after leading whitespace) before passing them to browser launchers.

Changes:

  • Add BaseBrowser._check_url() to reject leading-dash URLs with a ValueError.
  • Invoke _check_url() from multiple open() implementations that launch browsers.
  • Add a regression test and a Security NEWS blurb.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst Documents the security behavior change in webbrowser.open().
Lib/webbrowser.py Introduces URL validation and applies it to several browser controllers.
Lib/test/test_webbrowser.py Adds a test ensuring leading-dash inputs are rejected (currently for GenericBrowser).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/webbrowser.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/webbrowser.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/test_webbrowser.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson @tomcruiseqi
[3.10] gh-143930: Reject leading dashes in webbrowser URLs
c84b32d 
(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <[email protected]>
@tomcruiseqi
tomcruiseqi force-pushed the backport-82a24a4-3.10 branch from 69fd15b to c84b32d Compare March 24, 2026 07:16
@tomcruiseqi tomcruiseqi changed the title [3.10] gh-143930: Reject leading dashes in webbrowser URLs [3.10] gh-143930: Reject leading dashes in webbrowser URLs (GH-143931) Mar 24, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Mar 24, 2026
gh-143930: Reject leading dashes in webbrowser URLs #143931
Merged
@bedevere-app bedevere-app Bot added the type-security A security issue label Mar 24, 2026
@ambv
ambv merged commit ad4d5ba into python:3.10 Mar 24, 2026
15 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting review label Mar 24, 2026
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Mar 26, 2026
@tomcruiseqi @sethmlarson @hroncok
00478: CVE-2026-4519
996a010 
Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146359)

Cherry-picked from Python 3.10: ad4d5ba

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <[email protected]>
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Mar 26, 2026
@tomcruiseqi @sethmlarson @hroncok
00478: CVE-2026-4519
c0badc9 
Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146359)

(cherry picked from commit 82a24a4)

Backported from Python 3.10: ad4d5ba

Co-authored-by: Seth Michael Larson <[email protected]>
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request Oct 28, 2026
@tomcruiseqi @sethmlarson @icanhasmath
[3.10] pythongh-143930: Reject leading dashes in webbrowser URLs (pyt…
58011bd 
…honGH-143931) (pythonGH-146359)

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <[email protected]>
(cherry picked from commit ad4d5ba)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ambv ambv ambv left review comments
Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@tomcruiseqi @ambv @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.