From: Stan Ulbrych <stan@python.org>
Date: Mon, 13 Apr 2026 21:41:53 +0000 (+0100)
Subject: [PATCH] [3.10] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix... 
X-Git-Tag: archive/raspbian/3.9.2-1+rpi1+deb11u7^2~4
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=a20e7fcb5b131eb6fe3eda4cde32851e2ae4445f;p=python3.9.git

[PATCH] [3.10] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix check (GH-148170) (#148521)

(cherry picked from commit d22922c8a7958353689dc4763dd72da2dea03fff)
Origin: upstream, https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca

Gbp-Pq: Name CVE-2026-4519-3.patch
---

diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
index 89d66f4..e4921ba 100644
--- a/Lib/test/test_webbrowser.py
+++ b/Lib/test/test_webbrowser.py
@@ -99,6 +99,14 @@ class ChromeCommandTest(CommandTestMixin, unittest.TestCase):
                    options=[],
                    arguments=[URL])
 
+    def test_reject_action_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaises(ValueError):
+            browser.open('%action--incognito')
+        # new=1: action is "--new-window", so "%action" itself expands to
+        # a dash-prefixed flag even with no dash in the original URL.
+        with self.assertRaises(ValueError):
+            browser.open('%action', new=1)
 
 class MozillaCommandTest(CommandTestMixin, unittest.TestCase):
 
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
index 012e4bc..ba4d8df 100755
--- a/Lib/webbrowser.py
+++ b/Lib/webbrowser.py
@@ -264,7 +264,6 @@ class UnixBrowser(BaseBrowser):
 
     def open(self, url, new=0, autoraise=True):
         sys.audit("webbrowser.open", url)
-        self._check_url(url)
         if new == 0:
             action = self.remote_action
         elif new == 1:
@@ -278,7 +277,9 @@ class UnixBrowser(BaseBrowser):
             raise Error("Bad 'new' parameter to open(); " +
                         "expected 0, 1, or 2, got %s" % new)
 
-        args = [arg.replace("%s", url).replace("%action", action)
+        self._check_url(url.replace("%action", action))
+
+        args = [arg.replace("%action", action).replace("%s", url)
                 for arg in self.remote_args]
         args = [arg for arg in args if arg]
         success = self._invoke(args, True, autoraise, url)
diff --git a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
new file mode 100644
index 0000000..45cdeeb
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
@@ -0,0 +1,2 @@
+A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
+the dash-prefix safety check.