gh-137586: Open web browser with absolute path#137584
gh-137586: Open web browser with absolute path#137584fionn wants to merge 5 commits intopython:mainfrom
Conversation
|
All commit authors signed the Contributor License Agreement. |
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
091f610 to
8700060
Compare
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
|
Please open an issue first. |
|
Could you please add a news entry and also fix the osascript invocation in |
On macOS, web browsers are opened via popen calling osascript. However, if a user has a colliding osascript executable earlier in their PATH, this may fail or cause unwanted behaviour. Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
e9ed37f to
00682c5
Compare
|
Yes, done. I wasn't sure if this was significant enough to warrant a news item. |
|
#146439 takes a broader approach to this issue by replacing |
|
This is one think is worthwhile backporting given not relying on $PATH for this system binary seems like a good thing security wise. |
Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst
Outdated
Show resolved
Hide resolved
|
@fionn Please could you sign the CLA again? |
Co-authored-by: Hugo van Kemenade <[email protected]>
|
Ah, I guess this happened because I accepted the suggestion via the GitHub UI, which added a commit with the GitHub email address. I amended the commit to match the email address I signed the CLA with instead. |
|
Thanks, yes, that'll be it. But you'll still need to add the GH account email to the CLA when the first backport PR is opened. |
On macOS, web browsers are opened via
popencallingosascript. However, if a user has a collidingosascriptexecutable earlier in theirPATH, this may fail or cause unwanted behaviour.Depending on one's environment or level of paranoia, this may be considered a security vulnerability.