00478: CVE-2026-4519

Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146359)

(cherry picked from commit 82a24a4)

Backported from Python 3.10: ad4d5ba

Co-authored-by: Seth Michael Larson <seth@python.org>

Author: 2 people

Lib/test/test_webbrowser.py

@@ -53,6 +53,11 @@ def test_open(self):
                    options=[],
                    arguments=[URL])
 
+    def test_reject_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaises(ValueError):
+            browser.open(f"--key=val {URL}")
+
 
 class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 

Lib/webbrowser.py

@@ -120,6 +120,12 @@ def open_new(self, url):
     def open_new_tab(self, url):
         return self.open(url, 2)
 
+    @staticmethod
+    def _check_url(url):
+        """Ensures that the URL is safe to pass to subprocesses as a parameter"""
+        if url and url.lstrip().startswith("-"):
+            raise ValueError(f"Invalid URL: {url}")
+
 
 class GenericBrowser(BaseBrowser):
     """Class for all browsers started with a command
@@ -136,6 +142,7 @@ def __init__(self, name):
         self.basename = os.path.basename(self.name)
 
     def open(self, url, new=0, autoraise=True):
+        self._check_url(url)
         cmdline = [self.name] + [arg.replace("%s", url)
                                  for arg in self.args]
         try:
@@ -153,6 +160,7 @@ class BackgroundBrowser(GenericBrowser):
        background."""
 
     def open(self, url, new=0, autoraise=True):
+        self._check_url(url)
         cmdline = [self.name] + [arg.replace("%s", url)
                                  for arg in self.args]
         try:
@@ -219,6 +227,7 @@ def _invoke(self, args, remote, autoraise):
             return not p.wait()
 
     def open(self, url, new=0, autoraise=True):
+        self._check_url(url)
         if new == 0:
             action = self.remote_action
         elif new == 1:
@@ -319,6 +328,7 @@ class Konqueror(BaseBrowser):
     """
 
     def open(self, url, new=0, autoraise=True):
+        self._check_url(url)
         # XXX Currently I know no way to prevent KFM from opening a new win.
         if new == 2:
             action = "newTab"
@@ -402,6 +412,7 @@ def _remote(self, action):
         return 1
 
     def open(self, url, new=0, autoraise=True):
+        self._check_url(url)
         if new:
             ok = self._remote("LOADNEW " + url)
         else:
@@ -508,6 +519,7 @@ def register_X_browsers():
 if sys.platform[:3] == "win":
     class WindowsDefault(BaseBrowser):
         def open(self, url, new=0, autoraise=True):
+            self._check_url(url)
             try:
                 os.startfile(url)
             except OSError:
@@ -551,6 +563,7 @@ def __init__(self, name):
             self.name = name
 
         def open(self, url, new=0, autoraise=True):
+            self._check_url(url)
             assert "'" not in url
             # hack for local urls
             if not ':' in url:
@@ -588,6 +601,7 @@ def __init__(self, name):
             self._name = name
 
         def open(self, url, new=0, autoraise=True):
+            self._check_url(url)
             if self._name == 'default':
                 script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
             else:

Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst

@@ -0,0 +1 @@
+Reject leading dashes in URLs passed to :func:`webbrowser.open`