Repository navigation
Use absolute paths when invoking built-in shell commands #137586
Description
Bug report
Bug description:
On macOS, web browsers are opened via popen calling osascript.
Line 647 in 3964f97
However, if a user has a colliding osascript executable earlier in their PATH, this may fail or cause unwanted behaviour.
Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
CPython versions tested on:
CPython main branch, 3.13
Operating systems tested on:
macOS
Linked PRs
- gh-137586: Open external osascript program with absolute path #137584
- gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser #146439
- [3.14] gh-137586: Open external osascript program with absolute path (GH-137584) #148173
- [3.13] gh-137586: Open external osascript program with absolute path (GH-137584) #148174
- [3.12] gh-137586: Open external osascript program with absolute path (GH-137584) #148175
- [3.11] gh-137586: Open external osascript program with absolute path (GH-137584) #148176
- [3.10] gh-137586: Open external osascript program with absolute path (GH-137584) #148177
Activity
pythongh-137586: Use bundle IDs in MacOSX to prevent file injection v…
pythongh-137586: Load AppKit before NSWorkspace lookup in _macos_defa…
merwok commentedon Apr 6, 2026
Can the title be changed?
A shell builtin is a command like exec, help, fg or hash that the shell interprets by itself.
Commands like which, xdg-open or open are programs, which have a path and are invoked in a sub-process.
So it doesn’t make sense to talk about paths for shell builtins.
merwok commentedon Apr 6, 2026
Can you explain why this is a potential injection vector for Mac but not other operating systems? (browsers using UnixBrowser also use PATH search, not absolute paths)
pythongh-137586: Register chromium, opera, microsoft-edge in register…
gh-137586: Open external osascript program with absolute path (GH-137584
pythongh-137586: Open external osascript program with absolute path (p…
pythongh-137586: Open external osascript program with absolute path (p…
pythongh-137586: Open external osascript program with absolute path (p…
pythongh-137586: Open external osascript program with absolute path (p…
pythongh-137586: Open external osascript program with absolute path (p…
pythongh-137586: Fix Microsoft Edge bundle ID on macOS (com.microsoft…
pythongh-137586: Replace _macos_default_browser_bundle_id with plistl…
pythongh-137586: Rename MacOSX to MacOS
pythongh-137586: Use frozendict for MacOS._BUNDLE_IDS
pythongh-137586: Update webbrowser.rst for MacOS class, fix version d…
pythongh-137586: Revert frozendict for MacOS._BUNDLE_IDS pending froz…
pythongh-137586: Fix MacOSXOSAScript mangled to MacOSOSAScript in tes…
[3.14] gh-137586: Open external osascript program with absolute path (G…
[3.13] gh-137586: Open external osascript program with absolute path (G…
[3.12] gh-137586: Open external osascript program with absolute path (G…
[3.11] gh-137586: Open external osascript program with absolute path (G…
[3.10] gh-137586: Open external osascript program with absolute path (G…
pythongh-137586: Fix MacOS plist fallback, builtins.open shadow, add …
Merge branch 'main' into pythongh-137586-macosx-open
pythongh-137586: Address hugovk review comments
pythongh-137586: Address hugovk post-approval concerns
pythongh-137586: Fix Sphinx ref.class warnings in whatsnew/3.15.rst
pythongh-137586: Open external osascript program with absolute path (p…
Merge branch 'main' into pythongh-137586-macosx-open
gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser (#1…
gh-149496: Fix MacOSTest.test_default regression when BROWSER env var…
[3.15] gh-149496: Fix MacOSTest.test_default regression when BROWSER …