Skip to content

gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser #146439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
secengjeff wants to merge 26 commits into
base: main
Choose a base branch
from
Open

gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser #146439

Changes from 1 commit
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
00fa6c7
gh-137586: Add MacOSX browser class using /usr/bin/open, deprecate Ma…
secengjeff Mar 26, 2026
f697cd5
gh-137586: Add tests for MacOSX browser class and MacOSXOSAScript dep…
secengjeff Mar 26, 2026
7781033
gh-137586: Document MacOSXOSAScript deprecation in webbrowser docs
secengjeff Mar 26, 2026
6066221
gh-137586: Add NEWS entries for MacOSX webbrowser change
secengjeff Mar 26, 2026
d54293f
gh-137586: Fix NEWS entry class references with ! prefix to suppress …
secengjeff Mar 26, 2026
080197e
gh-137586: Fix MacOSXOSAScriptTest for MacOSX registration change
secengjeff Mar 26, 2026
fdd6649
gh-137586: Use bundle IDs in MacOSX to prevent file injection via OS …
secengjeff Mar 26, 2026
8e1eef4
gh-137586: Load AppKit before NSWorkspace lookup in _macos_default_br…
secengjeff Mar 26, 2026
e193626
gh-137586: Register chromium, opera, microsoft-edge in register_stand…
secengjeff Apr 6, 2026
98dd1d8
gh-137586: Fix Microsoft Edge bundle ID on macOS (com.microsoft.edgemac)
secengjeff Apr 6, 2026
bdfc2e6
gh-137586: Replace _macos_default_browser_bundle_id with plistlib to …
secengjeff Apr 6, 2026
614078f
gh-137586: Rename MacOSX to MacOS
secengjeff Apr 6, 2026
c77f4b8
gh-137586: Use frozendict for MacOS._BUNDLE_IDS
secengjeff Apr 6, 2026
c725927
gh-137586: Update webbrowser.rst for MacOS class, fix version directives
secengjeff Apr 6, 2026
1316dbf
gh-137586: Revert frozendict for MacOS._BUNDLE_IDS pending frozendict…
secengjeff Apr 6, 2026
612d276
gh-137586: Fix MacOSXOSAScript mangled to MacOSOSAScript in test rename
secengjeff Apr 6, 2026
386af23
Update Misc/NEWS.d/next/Library/2026-03-26-01-42-20.gh-issue-137586.K…
secengjeff Apr 23, 2026
e4e89f1
Update Misc/NEWS.d/next/Security/2026-03-26-01-42-15.gh-issue-137586.…
secengjeff Apr 23, 2026
b513903
Update Doc/library/webbrowser.rst
secengjeff Apr 23, 2026
aacbceb
Update Doc/library/webbrowser.rst
secengjeff Apr 23, 2026
a6d76d6
gh-137586: Fix MacOS plist fallback, builtins.open shadow, add Brave
secengjeff Apr 23, 2026
5a4fdad
Merge branch 'main' into gh-137586-macosx-open
secengjeff Apr 23, 2026
de9ec77
gh-137586: Address hugovk review comments
secengjeff Apr 23, 2026
6ddf67f
lazy import plistlib
gpshead Apr 23, 2026
f874d67
gh-137586: Address hugovk post-approval concerns
secengjeff Apr 23, 2026
3b390bb
gh-137586: Fix Sphinx ref.class warnings in whatsnew/3.15.rst
secengjeff Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update Misc/NEWS.d/next/Security/2026-03-26-01-42-15.gh-issue-137586.… 
…j3SkOm.rst

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
  • Loading branch information
@secengjeff @hugovk
secengjeff and hugovk authored Apr 23, 2026
commit e4e89f1a99cbc947ab4466400540551f9266a949
2 changes: 1 addition & 1 deletion Misc/NEWS.d/next/Security/2026-03-26-01-42-15.gh-issue-137586.j3SkOm.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Fix a PATH-injection vulnerability in :mod:`webbrowser` on macOS where
``osascript`` was invoked without an absolute path. The new :class:`!MacOSX`
``osascript`` was invoked without an absolute path. The new :class:`!MacOS`
class uses ``/usr/bin/open`` directly, eliminating the dependency on
``osascript`` entirely.
Loading