65 lines
2.7 KiB
Diff
65 lines
2.7 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Stan Ulbrych <stan@python.org>
|
|
Date: Mon, 13 Apr 2026 20:02:52 +0100
|
|
Subject: 00480: CVE-2026-4786
|
|
|
|
Fix webbrowser `%action` substitution bypass of dash-prefix check
|
|
---
|
|
Lib/test/test_webbrowser.py | 9 +++++++++
|
|
Lib/webbrowser.py | 5 +++--
|
|
.../2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst | 2 ++
|
|
3 files changed, 14 insertions(+), 2 deletions(-)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
|
|
|
|
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
|
|
index 60f094fd6a..e900c0212b 100644
|
|
--- a/Lib/test/test_webbrowser.py
|
|
+++ b/Lib/test/test_webbrowser.py
|
|
@@ -99,6 +99,15 @@ def test_open_new_tab(self):
|
|
options=[],
|
|
arguments=[URL])
|
|
|
|
+ def test_reject_action_dash_prefixes(self):
|
|
+ browser = self.browser_class(name=CMD_NAME)
|
|
+ with self.assertRaises(ValueError):
|
|
+ browser.open('%action--incognito')
|
|
+ # new=1: action is "--new-window", so "%action" itself expands to
|
|
+ # a dash-prefixed flag even with no dash in the original URL.
|
|
+ with self.assertRaises(ValueError):
|
|
+ browser.open('%action', new=1)
|
|
+
|
|
|
|
class EdgeCommandTest(CommandTestMixin, unittest.TestCase):
|
|
|
|
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
|
|
index 0bdb644d7d..79d410bcae 100755
|
|
--- a/Lib/webbrowser.py
|
|
+++ b/Lib/webbrowser.py
|
|
@@ -268,7 +268,6 @@ def _invoke(self, args, remote, autoraise, url=None):
|
|
|
|
def open(self, url, new=0, autoraise=True):
|
|
sys.audit("webbrowser.open", url)
|
|
- self._check_url(url)
|
|
if new == 0:
|
|
action = self.remote_action
|
|
elif new == 1:
|
|
@@ -282,7 +281,9 @@ def open(self, url, new=0, autoraise=True):
|
|
raise Error("Bad 'new' parameter to open(); " +
|
|
"expected 0, 1, or 2, got %s" % new)
|
|
|
|
- args = [arg.replace("%s", url).replace("%action", action)
|
|
+ self._check_url(url.replace("%action", action))
|
|
+
|
|
+ args = [arg.replace("%action", action).replace("%s", url)
|
|
for arg in self.remote_args]
|
|
args = [arg for arg in args if arg]
|
|
success = self._invoke(args, True, autoraise, url)
|
|
diff --git a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
|
|
new file mode 100644
|
|
index 0000000000..45cdeebe1b
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
|
|
@@ -0,0 +1,2 @@
|
|
+A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
|
|
+the dash-prefix safety check.
|