[issue25005] webbrowser breaks on query strings with multiple fields on Windows

[R. David Murray]

R. David Murray added the comment:

Thank you for reporting this.

I see that the Windows browser class uses shell=True, and that is wrong from a security standpoint.

This appears to be a regression from 3.4, introduced by issue 8232.  Since this is a security regression there either needs to be a fix or that changeset should be backed out.

----------
nosy: +r.david.murray
priority: normal -> release blocker
type: behavior -> security
versions: +Python 3.6

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue25005>
_______________________________________