Skip to content

[Security][Windows] webbrowser: WindowsDefault uses os.startfile() and so can be abused to run arbitrary commands #80202

Closed as not planned
@vstinner

Description

@vstinner
BPO 36021
Nosy @pfmoore, @vstinner, @tjguk, @zware, @eryksun, @zooba, @matrixise, @JulienPalard
PRs
  • WIP: bpo-36021: WindowsDefault does not execute os.startfile() for a local file #11931
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2019-02-18.11:00:53.128>
    labels = ['type-security', '3.8', '3.9', '3.10', 'library', 'OS-windows']
    title = '[Security][Windows] webbrowser: WindowsDefault uses os.startfile() and so can be abused to run arbitrary commands'
    updated_at = <Date 2021-03-04.18:56:07.574>
    user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2021-03-04.18:56:07.574>
    actor = 'eryksun'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Library (Lib)', 'Windows']
    creation = <Date 2019-02-18.11:00:53.128>
    creator = 'vstinner'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 36021
    keywords = ['patch']
    message_count = 25.0
    messages = ['335805', '335806', '335813', '335827', '335941', '335942', '335948', '335954', '335957', '335959', '335967', '335979', '336004', '336039', '336042', '336064', '336079', '336090', '336092', '336094', '336096', '336097', '336098', '336101', '338721']
    nosy_count = 8.0
    nosy_names = ['paul.moore', 'vstinner', 'tim.golden', 'zach.ware', 'eryksun', 'steve.dower', 'matrixise', 'mdk']
    pr_nums = ['11931']
    priority = 'normal'
    resolution = None
    stage = 'patch review'
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue36021'
    versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10only security fixes3.8 (EOL)end of life3.9only security fixesOS-windowsstdlibPython modules in the Lib dirtype-securityA security issue

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions