poky/meta/recipes-devtools/python/python3/CVE-2026-4519_p2.patch

From 3ca64ff1722d2410a4e50e760de70f6279fa99fa Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Sat, 4 Apr 2026 00:53:49 +0200
Subject: [PATCH] [3.11] gh-143930: Tweak the exception message and
 increase test coverage (GH-146476) (GH-148045) (GH-148051) (GH-148052)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CVE: CVE-2026-4519
Upstream-Status: Backport [https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c]

Backport Changes:
- This file is not present in the current version and is therefore omitted.
  Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
- The file introduced in v3.12 by this commit;
  https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48

(cherry picked from commit cc023511238ad93ecc8796157c6f9139a2bb2932)
(cherry picked from commit 89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4)
(cherry picked from commit 3681d47a440865aead912a054d4599087b4270dd)

Co-authored-by: Łukasz Langa <lukasz@langa.pl>
(cherry picked from commit 96fc5048605863c7b6fd6289643feb0e97edd96c)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
---
 Lib/test/test_webbrowser.py | 81 ++++++++++++++++++++++++++++++++++---
 Lib/webbrowser.py           |  2 +-
 2 files changed, 76 insertions(+), 7 deletions(-)

diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
index 60f094fd6a1..c9bf525360d 100644
--- a/Lib/test/test_webbrowser.py
+++ b/Lib/test/test_webbrowser.py
@@ -1,6 +1,7 @@
+import io
+import os
 import webbrowser
 import unittest
-import os
 import sys
 import subprocess
 from unittest import mock
@@ -49,6 +50,14 @@ class CommandTestMixin:
             popen_args.pop(popen_args.index(option))
         self.assertEqual(popen_args, arguments)
 
+    def test_reject_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaisesRegex(
+            ValueError,
+            r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
+        ):
+            browser.open(f"--key=val {URL}")
+
 
 class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 
@@ -59,11 +68,6 @@ class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
                    options=[],
                    arguments=[URL])
 
-    def test_reject_dash_prefixes(self):
-        browser = self.browser_class(name=CMD_NAME)
-        with self.assertRaises(ValueError):
-            browser.open(f"--key=val {URL}")
-
 
 class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 
@@ -224,6 +228,71 @@ class ELinksCommandTest(CommandTestMixin, unittest.TestCase):
                    arguments=['openURL({},new-tab)'.format(URL)])
 
 
+class MockPopenPipe:
+    def __init__(self, cmd, mode):
+        self.cmd = cmd
+        self.mode = mode
+        self.pipe = io.StringIO()
+        self._closed = False
+
+    def write(self, buf):
+        self.pipe.write(buf)
+
+    def close(self):
+        self._closed = True
+        return None
+
+
+@unittest.skipUnless(sys.platform == "darwin", "macOS specific test")
+class MacOSXOSAScriptTest(unittest.TestCase):
+    def setUp(self):
+        # Ensure that 'BROWSER' is not set to 'open' or something else.
+        # See: https://github.com/python/cpython/issues/131254.
+        env = self.enterContext(os_helper.EnvironmentVarGuard())
+        env.unset("BROWSER")
+
+        support.patch(self, os, "popen", self.mock_popen)
+        self.browser = webbrowser.MacOSXOSAScript("default")
+
+    def mock_popen(self, cmd, mode):
+        self.popen_pipe = MockPopenPipe(cmd, mode)
+        return self.popen_pipe
+
+    def test_default(self):
+        browser = webbrowser.get()
+        assert isinstance(browser, webbrowser.MacOSXOSAScript)
+        self.assertEqual(browser.name, "default")
+
+    def test_default_open(self):
+        url = "https://python.org"
+        self.browser.open(url)
+        self.assertTrue(self.popen_pipe._closed)
+        self.assertEqual(self.popen_pipe.cmd, "osascript")
+        script = self.popen_pipe.pipe.getvalue()
+        self.assertEqual(script.strip(), f'open location "{url}"')
+
+    def test_url_quote(self):
+        self.browser.open('https://python.org/"quote"')
+        script = self.popen_pipe.pipe.getvalue()
+        self.assertEqual(
+            script.strip(), 'open location "https://python.org/%22quote%22"'
+        )
+
+    def test_explicit_browser(self):
+        browser = webbrowser.MacOSXOSAScript("safari")
+        browser.open("https://python.org")
+        script = self.popen_pipe.pipe.getvalue()
+        self.assertIn('tell application "safari"', script)
+        self.assertIn('open location "https://python.org"', script)
+
+    def test_reject_dash_prefixes(self):
+        with self.assertRaisesRegex(
+            ValueError,
+            r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
+        ):
+            self.browser.open(f"--key=val {URL}")
+
+
 class BrowserRegistrationTest(unittest.TestCase):
 
     def setUp(self):
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
index 0bdb644d7db..000e89275b7 100755
--- a/Lib/webbrowser.py
+++ b/Lib/webbrowser.py
@@ -162,7 +162,7 @@ class BaseBrowser(object):
     def _check_url(url):
         """Ensures that the URL is safe to pass to subprocesses as a parameter"""
         if url and url.lstrip().startswith("-"):
-            raise ValueError(f"Invalid URL: {url}")
+            raise ValueError(f"Invalid URL (leading dash disallowed): {url!r}")
 
 
 class GenericBrowser(BaseBrowser):
-- 
2.35.6