Skip to content

gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check#148170

Merged
StanFromIreland merged 5 commits intopython:mainfrom
StanFromIreland:webbrowser-fix
Apr 13, 2026
Merged

gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check#148170
StanFromIreland merged 5 commits intopython:mainfrom
StanFromIreland:webbrowser-fix

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland commented Apr 6, 2026 •
edited by bedevere-app bot
Loading

@bedevere-app bedevere-app bot mentioned this pull request Apr 6, 2026
Open
@StanFromIreland StanFromIreland requested review from ambv and gpshead April 6, 2026 15:14
gpshead
gpshead reviewed Apr 6, 2026
View reviewed changes
@StanFromIreland StanFromIreland requested a review from gpshead April 6, 2026 17:34
@StanFromIreland StanFromIreland enabled auto-merge (squash) April 13, 2026 18:34
@StanFromIreland
Copy link
Copy Markdown
Member Author

StanFromIreland commented Apr 13, 2026

Thanks for the reviews!

@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026
@StanFromIreland StanFromIreland merged commit d22922c into python:main Apr 13, 2026
61 checks passed
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148169: Fix webbrowser %action substitution bypass of dash…
f529b94 
…-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148169: Fix webbrowser %action substitution bypass of dash…
5b5617a 
…-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d22922c8a7958353689dc4763dd72da2dea03fff 3.12

@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148517 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d22922c8a7958353689dc4763dd72da2dea03fff 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d22922c8a7958353689dc4763dd72da2dea03fff 3.10

@StanFromIreland StanFromIreland deleted the webbrowser-fix branch April 13, 2026 19:05
@StanFromIreland StanFromIreland removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148516 is a backport of this pull request to the 3.14 branch.

StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.12] pythongh-148169: Fix webbrowser %action substitution bypass …
a59e9cb 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148519 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.12] pythongh-148169: Fix webbrowser %action substitution bypass …
1016d82 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] pythongh-148169: Fix webbrowser %action substitution bypass …
d57576d 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148520 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.10] pythongh-148169: Fix webbrowser %action substitution bypass …
881ff02 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148521 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 13, 2026
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] gh-148169: Fix webbrowser %action substitution bypass of das…
f465482 
…h-prefix check (GH-148170) (#148520)

(cherry picked from commit d22922c)
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.10] gh-148169: Fix webbrowser %action substitution bypass of das…
c5767a7 
…h-prefix check (GH-148170) (#148521)

(cherry picked from commit d22922c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@sethmlarson sethmlarson sethmlarson approved these changes

@ambv ambv Awaiting requested review from ambv

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@StanFromIreland @gpshead @sethmlarson