Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-143930: Reject leading dashes in webbrowser URLs#143931

Merged
sethmlarson merged 1 commit intopython:mainfrom
sethmlarson:reject-leading-dash-webbrowser-open
Mar 20, 2026
Merged

gh-143930: Reject leading dashes in webbrowser URLs#143931
sethmlarson merged 1 commit intopython:mainfrom
sethmlarson:reject-leading-dash-webbrowser-open

Conversation

@sethmlarson
Copy link
Contributor

@sethmlarsonsethmlarson commentedJan 16, 2026
edited by bedevere-appbot
Loading

@sethmlarsonsethmlarson added type-securityA security issue needs backport to 3.10only security fixes stdlibStandard Library Python modules in the Lib/ directory needs backport to 3.11only security fixes needs backport to 3.12only security fixes needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsJan 16, 2026
@Yhg1s
Copy link
Member

What about / or other common option prefixes?

@sethmlarson
Copy link
ContributorAuthor

@Yhg1s I'm concerned that there are use-cases for callingwebbrowser.open() on paths, so we'd have to be more cautious in this case. Another option I suggested was to percent-encode spaces?

@gpshead
Copy link
Member

on windows a '/' prefix is typically a command line flag - does it actually work as an absolute current drive path on edge/chrome/firefox? to be a url for that it really should be "file://"

@sethmlarson
Copy link
ContributorAuthor

Yeah we currently support opening absolute paths via/index.html as a URL. Maybe we want to deprecate this in favor of forcing folks to usefile:// but doing so here would result in breakages most likely. Let's move forward with only leading dashes for now.

@sethmlarsonsethmlarson merged commit82a24a4 intopython:mainMar 20, 2026
67 checks passed
@miss-islington-app
Copy link

Thanks@sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

@sethmlarsonsethmlarson deleted the reject-leading-dash-webbrowser-open branchMarch 20, 2026 14:47
@miss-islington-app
Copy link

Sorry,@sethmlarson, I could not cleanly backport this to3.12 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.12

@miss-islington-app
Copy link

Sorry,@sethmlarson, I could not cleanly backport this to3.11 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.11

@miss-islington-app
Copy link

Sorry,@sethmlarson, I could not cleanly backport this to3.10 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.10

@bedevere-app
Copy link

GH-146364 is a backport of this pull request to the3.11 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.11only security fixes labelMar 24, 2026
@bedevere-app
Copy link

GH-146364 is a backport of this pull request to the3.11 branch.

@bedevere-app
Copy link

GH-146359 is a backport of this pull request to the3.10 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.10only security fixes labelMar 24, 2026
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@gpsheadgpsheadgpshead approved these changes

Assignees

@sethmlarsonsethmlarson

Labels

needs backport to 3.12only security fixesneeds backport to 3.13bugs and security fixesneeds backport to 3.14bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sethmlarson@Yhg1s@gpshead

[8]ページ先頭

©2009-2026 Movatter.jp