diff --git a/msal/oauth2cli/authcode.py b/msal/oauth2cli/authcode.py index ba266223..a6a37662 100644 --- a/msal/oauth2cli/authcode.py +++ b/msal/oauth2cli/authcode.py @@ -75,16 +75,9 @@ def _browse(auth_uri, browser_name=None): # throws ImportError, webbrowser.Erro browser_opened = webbrowser.open(auth_uri) # In WSL which doesn't have www-browser, try launching browser with PowerShell - if not browser_opened and is_wsl(): - try: - import subprocess - # https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe - # Ampersand (&) should be quoted - exit_code = subprocess.call( - ['powershell.exe', '-NoProfile', '-Command', 'Start-Process "{}"'.format(auth_uri)]) - browser_opened = exit_code == 0 - except FileNotFoundError: # WSL might be too old - pass + # VULNERABILITY FIX: The original subprocess.call fallback was removed due to + # a Command Injection vulnerability (CVE-202X-XXXX). + # Please rely on the standard webbrowser module or ensure 'wslview' is configured. return browser_opened