Repository navigation
Use absolute paths when invoking built-in shell commands #137586
Description
Bug report
Bug description:
On macOS, web browsers are opened via popen calling osascript.
Line 647 in 3964f97
However, if a user has a colliding osascript executable earlier in their PATH, this may fail or cause unwanted behaviour.
Depending on one's environment or level of paranoia, this may be considered a security vulnerability.
CPython versions tested on:
CPython main branch, 3.13
Operating systems tested on:
macOS
Linked PRs
- gh-137586: Open external osascript program with absolute path #137584
- gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser #146439
- [3.14] gh-137586: Open external osascript program with absolute path (GH-137584) #148173
- [3.13] gh-137586: Open external osascript program with absolute path (GH-137584) #148174
- [3.12] gh-137586: Open external osascript program with absolute path (GH-137584) #148175
- [3.11] gh-137586: Open external osascript program with absolute path (GH-137584) #148176
- [3.10] gh-137586: Open external osascript program with absolute path (GH-137584) #148177
Activity
picnixz commentedon Aug 9, 2025
Note that there's also an occurrence in
Lib/turtledemo/__init__.pywhich usessubprocess.runinstead. There is also a similar occurrence inLib/platform.pywhere we directly usefileinstead of/usr/bin/fileandunameinstead of/usr/bin/uname. Finally, there's another occurrence inwebbrowser.pythat usesxdg-settingsdirectly.Unless I'm mistaken, taking control over the PATH environment variable of another user is quite complex, if not impossible most of the time if we don't have enough privilieges or if the PATH is already misconfigured. Therefore, I wouldn't really count it as a security issue as the attack surface is quite small. However, I think it's better if we use full paths instead, especially for built-in commands.
It's quite hard to spot all places where we don't use an absolute path though.
[-]Use absolute path when calling osascript[/-][+]Use absolute paths when invoking built-in shell commands[/+]terryjreedy commentedon Oct 17, 2025
This is about a simple change of the osascript path on mac for webbrowser, its test, and in turtledemo.
@ronaldoussoren, @ned-deily can one of you verify/review the few lines of changes in the PR?
pythongh-137586: Add MacOSX browser class using /usr/bin/open, deprec…
pythongh-137586: Add tests for MacOSX browser class and MacOSXOSAScri…
pythongh-137586: Document MacOSXOSAScript deprecation in webbrowser docs
secengjeff commentedon Mar 26, 2026
#146439 addresses this by replacing
MacOSXOSAScriptentirely with a newMacOSXclass that uses/usr/bin/openviasubprocess.run. This eliminates theosascriptdependency rather than patching the path, which also resolves the broader usability problem ofwebbrowser.open()failing silently on managed endpoints whereosascriptis blocked.pythongh-137586: Add NEWS entries for MacOSX webbrowser change
pythongh-137586: Fix NEWS entry class references with ! prefix to sup…
pythongh-137586: Fix MacOSXOSAScriptTest for MacOSX registration change
21 remaining items
[3.13] gh-137586: Open external osascript program with absolute path (G…
[3.12] gh-137586: Open external osascript program with absolute path (G…
[3.11] gh-137586: Open external osascript program with absolute path (G…
[3.10] gh-137586: Open external osascript program with absolute path (G…
pythongh-137586: Fix MacOS plist fallback, builtins.open shadow, add …
Merge branch 'main' into pythongh-137586-macosx-open
pythongh-137586: Address hugovk review comments
pythongh-137586: Address hugovk post-approval concerns
pythongh-137586: Fix Sphinx ref.class warnings in whatsnew/3.15.rst
pythongh-137586: Open external osascript program with absolute path (p…
Merge branch 'main' into pythongh-137586-macosx-open
gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser (#1…
gh-149496: Fix MacOSTest.test_default regression when BROWSER env var…
[3.15] gh-149496: Fix MacOSTest.test_default regression when BROWSER …