Open web browser with absolute path

fionn · fionn · commit 8700060a3daf · 2025-08-09T16:37:31.000+08:00
On macOS, web browsers are opened via popen calling osascript. However,
if a user has a colliding osascript executable earlier in their PATH,
this may fail or cause unwanted behaviour.

Depending on one's environment or level of paranoia, this may be
considered a security vulnerability.
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
@@ -343,7 +343,7 @@ def test_default_open(self):
         url = "https://python.org"
         self.browser.open(url)
         self.assertTrue(self.popen_pipe._closed)
-        self.assertEqual(self.popen_pipe.cmd, "osascript")
+        self.assertEqual(self.popen_pipe.cmd, "/usr/bin/osascript")
         script = self.popen_pipe.pipe.getvalue()
         self.assertEqual(script.strip(), f'open location "{url}"')
 
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
@@ -644,7 +644,7 @@ def open(self, url, new=0, autoraise=True):
                    end
                    '''
 
-            osapipe = os.popen("osascript", "w")
+            osapipe = os.popen("/usr/bin/osascript", "w")
             if osapipe is None:
                 return False
 
