[issue8232] webbrowser.open incomplete on Windows

[Steve Dower]

Steve Dower added the comment:

Here's an alternate patch I proposed on #25005 before we decided to back out the change.

The problem is that subprocess.call() with shell=True is unsafe because we don't escape shell operators (such as &, <, >, |).

The fix in this patch is to allow passing arguments to os.startfile so we can use that instead. Arguments do not need to be escaped in this case.

----------
Added file: http://bugs.python.org/file40384/25005_1.patch

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue8232>
_______________________________________