[issue36021] [Security][Windows] webbrowser: WindowsDefault uses os.startfile() and so can be abused to run arbitrary commands

[STINNER Victor]

STINNER Victor <vstinner at redhat.com> added the comment:

>     >>> os.startfile('file:///C:/Temp/test/test.exe')

Oh, startfile() also runs a program for an URL using file:// scheme? If yes, it becomes even more complex to fix this file :-/

How do you decide if an URL start with file:// is safe?

----------

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36021>
_______________________________________