Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package python315 for openSUSE:Factory 
checked in at 2026-03-31 15:22:41
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python315 (Old)
 and      /work/SRC/openSUSE:Factory/.python315.new.1999 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "python315"

Tue Mar 31 15:22:41 2026 rev:9 rq:1343740 version:3.15.0~a7

Changes:
--------
--- /work/SRC/openSUSE:Factory/python315/python315.changes      2026-03-22 
14:13:13.611959170 +0100
+++ /work/SRC/openSUSE:Factory/.python315.new.1999/python315.changes    
2026-03-31 15:23:44.759961580 +0200
@@ -1,0 +2,28 @@
+Fri Mar 27 17:51:07 UTC 2026 - Matej Cepl <[email protected]>
+
+- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
+  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
+  gh#python/cpython#143930).
+
+-------------------------------------------------------------------
+Wed Mar 25 16:40:18 UTC 2026 - Matej Cepl <[email protected]>
+
+- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
+  TarInfo DIRTYPE normalization during GNU long name handling
+  (bsc#1259611, CVE-2025-13462).
+
+-------------------------------------------------------------------
+Mon Mar 23 22:16:01 UTC 2026 - Matej Cepl <[email protected]>
+
+- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
+  unbound C recursion in conv_content_model in pyexpat.c
+  (bsc#1259735, CVE-2026-4224).
+
+-------------------------------------------------------------------
+Mon Mar 23 17:15:50 UTC 2026 - Matej Cepl <[email protected]>
+
+- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
+  control characters in http.cookies.Morsel.update() and
+  http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).
+
+-------------------------------------------------------------------

New:
----
  CVE-2025-13462-tarinfo-header-parse.patch
  CVE-2026-3644-cookies-Morsel-update-II.patch
  CVE-2026-4224-expat-unbound-C-recursion.patch
  CVE-2026-4519-webbrowser-open-dashes.patch

----------(New B)----------
  New:
- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
  TarInfo DIRTYPE normalization during GNU long name handling
  New:
- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
  control characters in http.cookies.Morsel.update() and
  New:
- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
  unbound C recursion in conv_content_model in pyexpat.c
  New:
- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
----------(New E)----------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ python315.spec ++++++
--- /var/tmp/diff_new_pack.9vV1Qm/_old  2026-03-31 15:23:46.696042235 +0200
+++ /var/tmp/diff_new_pack.9vV1Qm/_new  2026-03-31 15:23:46.700042402 +0200
@@ -237,6 +237,18 @@
 # PATCH-FIX-UPSTREAM gh-144741-frame_pointer_unwind.patch 
gh#python/cpython#144741 [email protected]
 # Fix test_frame_pointer_unwind for libpython
 Patch46:        gh-144741-frame_pointer_unwind.patch
+# PATCH-FIX-UPSTREAM CVE-2026-3644-cookies-Morsel-update-II.patch bsc#1259734 
[email protected]
+# Reject control characters in http.cookies.Morsel.update() and 
http.cookies.BaseCookie.js_output
+Patch47:        CVE-2026-3644-cookies-Morsel-update-II.patch
+# PATCH-FIX-UPSTREAM CVE-2026-4224-expat-unbound-C-recursion.patch bsc#1259735 
[email protected]
+# Avoid unbound C recursion in conv_content_model
+Patch48:        CVE-2026-4224-expat-unbound-C-recursion.patch
+# PATCH-FIX-UPSTREAM CVE-2025-13462-tarinfo-header-parse.patch bsc#1259611 
[email protected]
+# Skip TarInfo DIRTYPE normalization during GNU long name handling
+Patch49:        CVE-2025-13462-tarinfo-header-parse.patch
+# PATCH-FIX-UPSTREAM CVE-2026-4519-webbrowser-open-dashes.patch bsc#1260026 
[email protected]
+# reject leading dashes in webbrowser URLs
+Patch50:        CVE-2026-4519-webbrowser-open-dashes.patch
 #### Python 3.15 DEVELOPMENT PATCHES
 BuildRequires:  autoconf-archive
 BuildRequires:  automake

++++++ CVE-2025-13462-tarinfo-header-parse.patch ++++++
>From 861656d8c21d329366e50c5081500d5941ebf566 Mon Sep 17 00:00:00 2001
From: Eashwar Ranganathan <[email protected]>
Date: Tue, 18 Nov 2025 06:12:40 -0500
Subject: [PATCH] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long
 name handling

---
 Lib/tarfile.py                                                          |   29 
++++++++--
 Lib/test/test_tarfile.py                                                |   19 
++++++
 Misc/ACKS                                                               |    1 
 Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst |    2 
 4 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 
Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst

Index: Python-3.15.0a7/Lib/tarfile.py
===================================================================
--- Python-3.15.0a7.orig/Lib/tarfile.py 2026-03-25 17:39:01.236324898 +0100
+++ Python-3.15.0a7/Lib/tarfile.py      2026-03-25 17:39:16.163869411 +0100
@@ -1276,6 +1276,20 @@
     @classmethod
     def frombuf(cls, buf, encoding, errors):
         """Construct a TarInfo object from a 512 byte bytes object.
+
+        To support the old v7 tar format AREGTYPE headers are
+        transformed to DIRTYPE headers if their name ends in '/'.
+        """
+        return cls._frombuf(buf, encoding, errors)
+
+    @classmethod
+    def _frombuf(cls, buf, encoding, errors, *, dircheck=True):
+        """Construct a TarInfo object from a 512 byte bytes object.
+
+        If ``dircheck`` is set to ``True`` then ``AREGTYPE`` headers will
+        be normalized to ``DIRTYPE`` if the name ends in a trailing slash.
+        ``dircheck`` must be set to ``False`` if this function is called
+        on a follow-up header such as ``GNUTYPE_LONGNAME``.
         """
         if len(buf) == 0:
             raise EmptyHeaderError("empty header")
@@ -1306,7 +1320,7 @@
 
         # Old V7 tar format represents a directory as a regular
         # file with a trailing slash.
-        if obj.type == AREGTYPE and obj.name.endswith("/"):
+        if dircheck and obj.type == AREGTYPE and obj.name.endswith("/"):
             obj.type = DIRTYPE
 
         # The old GNU sparse format occupies some of the unused
@@ -1341,8 +1355,15 @@
         """Return the next TarInfo object from TarFile object
            tarfile.
         """
+        return cls._fromtarfile(tarfile)
+
+    @classmethod
+    def _fromtarfile(cls, tarfile, *, dircheck=True):
+        """
+        See dircheck documentation in _frombuf().
+        """
         buf = tarfile.fileobj.read(BLOCKSIZE)
-        obj = cls.frombuf(buf, tarfile.encoding, tarfile.errors)
+        obj = cls._frombuf(buf, tarfile.encoding, tarfile.errors, 
dircheck=dircheck)
         obj.offset = tarfile.fileobj.tell() - BLOCKSIZE
         return obj._proc_member(tarfile)
 
@@ -1400,7 +1421,7 @@
 
         # Fetch the next header and process it.
         try:
-            next = self.fromtarfile(tarfile)
+            next = self._fromtarfile(tarfile, dircheck=False)
         except HeaderError as e:
             raise SubsequentHeaderError(str(e)) from None
 
@@ -1535,7 +1556,7 @@
 
         # Fetch the next header.
         try:
-            next = self.fromtarfile(tarfile)
+            next = self._fromtarfile(tarfile, dircheck=False)
         except HeaderError as e:
             raise SubsequentHeaderError(str(e)) from None
 
Index: Python-3.15.0a7/Lib/test/test_tarfile.py
===================================================================
--- Python-3.15.0a7.orig/Lib/test/test_tarfile.py       2026-03-25 
17:39:03.781257203 +0100
+++ Python-3.15.0a7/Lib/test/test_tarfile.py    2026-03-25 17:39:16.165749330 
+0100
@@ -1234,6 +1234,25 @@
                 self.assertIsNotNone(tar.getmember(longdir))
                 self.assertIsNotNone(tar.getmember(longdir.removesuffix('/')))
 
+    def test_longname_file_not_directory(self):
+        # Test reading a longname file and ensure it is not handled as a 
directory
+        # Issue #141707
+        buf = io.BytesIO()
+        with tarfile.open(mode='w', fileobj=buf, format=self.format) as tar:
+            ti = tarfile.TarInfo()
+            ti.type = tarfile.AREGTYPE
+            ti.name = ('a' * 99) + '/' + ('b' * 3)
+            tar.addfile(ti)
+
+            expected = {t.name: t.type for t in tar.getmembers()}
+
+        buf.seek(0)
+        with tarfile.open(mode='r', fileobj=buf) as tar:
+            actual = {t.name: t.type for t in tar.getmembers()}
+
+        self.assertEqual(expected, actual)
+
+
 class GNUReadTest(LongnameTest, ReadTest, unittest.TestCase):
 
     subdir = "gnu"
Index: Python-3.15.0a7/Misc/ACKS
===================================================================
--- Python-3.15.0a7.orig/Misc/ACKS      2026-03-10 13:31:15.000000000 +0100
+++ Python-3.15.0a7/Misc/ACKS   2026-03-25 17:39:16.166294347 +0100
@@ -1557,6 +1557,7 @@
 Jeff Ramnani
 Grant Ramsay
 Bayard Randel
+Eashwar Ranganathan
 Varpu Rantala
 Brodie Rao
 Rémi Rampin
Index: 
Python-3.15.0a7/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
===================================================================
--- /dev/null   1970-01-01 00:00:00.000000000 +0000
+++ 
Python-3.15.0a7/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
     2026-03-25 17:39:16.166510375 +0100
@@ -0,0 +1,2 @@
+Don't change :class:`tarfile.TarInfo` type from ``AREGTYPE`` to ``DIRTYPE`` 
when parsing
+GNU long name or link headers.

++++++ CVE-2026-3644-cookies-Morsel-update-II.patch ++++++
>From 87d0887c4fde85232894f84ca0f7f06947b73693 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <[email protected]>
Date: Fri, 6 Mar 2026 08:00:24 +0000
Subject: [PATCH 1/7] Patch

---
 Lib/http/cookies.py                                                      |   
24 +++++-
 Lib/test/test_http_cookies.py                                            |   
38 ++++++++++
 Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst |    
4 +
 3 files changed, 62 insertions(+), 4 deletions(-)

Index: Python-3.15.0a7/Lib/http/cookies.py
===================================================================
--- Python-3.15.0a7.orig/Lib/http/cookies.py    2026-03-23 18:14:51.598158870 
+0100
+++ Python-3.15.0a7/Lib/http/cookies.py 2026-03-23 18:14:58.972522700 +0100
@@ -337,9 +337,16 @@
             key = key.lower()
             if key not in self._reserved:
                 raise CookieError("Invalid attribute %r" % (key,))
+            if _has_control_character(key, val):
+                raise CookieError("Control characters are not allowed in "
+                                  f"cookies {key!r} {val!r}")
             data[key] = val
         dict.update(self, data)
 
+    def __ior__(self, values):
+        self.update(values)
+        return self
+
     def isReservedKey(self, K):
         return K.lower() in self._reserved
 
@@ -365,9 +372,15 @@
         }
 
     def __setstate__(self, state):
-        self._key = state['key']
-        self._value = state['value']
-        self._coded_value = state['coded_value']
+        key = state['key']
+        value = state['value']
+        coded_value = state['coded_value']
+        if _has_control_character(key, value, coded_value):
+            raise CookieError("Control characters are not allowed in cookies "
+                              f"{key!r} {value!r} {coded_value!r}")
+        self._key = key
+        self._value = value
+        self._coded_value = coded_value
 
     def output(self, attrs=None, header="Set-Cookie:"):
         return "%s %s" % (header, self.OutputString(attrs))
@@ -379,13 +392,16 @@
 
     def js_output(self, attrs=None):
         # Print javascript
+        output_string = self.OutputString(attrs)
+        if _has_control_character(output_string):
+            raise CookieError("Control characters are not allowed in cookies")
         return """
         <script type="text/javascript">
         <!-- begin hiding
         document.cookie = \"%s\";
         // end hiding -->
         </script>
-        """ % (self.OutputString(attrs).replace('"', r'\"'))
+        """ % (output_string.replace('"', r'\"'))
 
     def OutputString(self, attrs=None):
         # Build up our result
Index: Python-3.15.0a7/Lib/test/test_http_cookies.py
===================================================================
--- Python-3.15.0a7.orig/Lib/test/test_http_cookies.py  2026-03-23 
18:14:54.687133607 +0100
+++ Python-3.15.0a7/Lib/test/test_http_cookies.py       2026-03-23 
18:14:58.973140104 +0100
@@ -604,6 +604,14 @@
             with self.assertRaises(cookies.CookieError):
                 morsel["path"] = c0
 
+            # .__setstate__()
+            with self.assertRaises(cookies.CookieError):
+                morsel.__setstate__({'key': c0, 'value': 'val', 'coded_value': 
'coded'})
+            with self.assertRaises(cookies.CookieError):
+                morsel.__setstate__({'key': 'key', 'value': c0, 'coded_value': 
'coded'})
+            with self.assertRaises(cookies.CookieError):
+                morsel.__setstate__({'key': 'key', 'value': 'val', 
'coded_value': c0})
+
             # .setdefault()
             with self.assertRaises(cookies.CookieError):
                 morsel.setdefault("path", c0)
@@ -618,6 +626,18 @@
             with self.assertRaises(cookies.CookieError):
                 morsel.set("path", "val", c0)
 
+            # .update()
+            with self.assertRaises(cookies.CookieError):
+                morsel.update({"path": c0})
+            with self.assertRaises(cookies.CookieError):
+                morsel.update({c0: "val"})
+
+            # .__ior__()
+            with self.assertRaises(cookies.CookieError):
+                morsel |= {"path": c0}
+            with self.assertRaises(cookies.CookieError):
+                morsel |= {c0: "val"}
+
     def test_control_characters_output(self):
         # Tests that even if the internals of Morsel are modified
         # that a call to .output() has control character safeguards.
@@ -638,6 +658,24 @@
             with self.assertRaises(cookies.CookieError):
                 cookie.output()
 
+        # Tests that .js_output() also has control character safeguards.
+        for c0 in support.control_characters_c0():
+            morsel = cookies.Morsel()
+            morsel.set("key", "value", "coded-value")
+            morsel._key = c0  # Override private variable.
+            cookie = cookies.SimpleCookie()
+            cookie["cookie"] = morsel
+            with self.assertRaises(cookies.CookieError):
+                cookie.js_output()
+
+            morsel = cookies.Morsel()
+            morsel.set("key", "value", "coded-value")
+            morsel._coded_value = c0  # Override private variable.
+            cookie = cookies.SimpleCookie()
+            cookie["cookie"] = morsel
+            with self.assertRaises(cookies.CookieError):
+                cookie.js_output()
+
 
 def load_tests(loader, tests, pattern):
     tests.addTest(doctest.DocTestSuite(cookies))
Index: 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
===================================================================
--- /dev/null   1970-01-01 00:00:00.000000000 +0000
+++ 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
    2026-03-23 18:14:58.972149356 +0100
@@ -0,0 +1,4 @@
+Reject control characters in :class:`http.cookies.Morsel`
+:meth:`~http.cookies.Morsel.update` and
+:meth:`~http.cookies.BaseCookie.js_output`.
+This addresses :cve:`2026-3644`.

++++++ CVE-2026-4224-expat-unbound-C-recursion.patch ++++++
>From d3dd83794717ad183a9de1cd9bff7940e6b024f4 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <[email protected]>
Date: Sat, 14 Mar 2026 17:35:27 +0000
Subject: [PATCH 1/7] Fix crash in `conv_content_model` function in `pyexpat`

---
 Lib/test/test_pyexpat.py                                                 |   
19 ++++++++++
 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst |    
4 ++
 Modules/pyexpat.c                                                        |    
9 ++++
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 
Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst

Index: Python-3.15.0a7/Lib/test/test_pyexpat.py
===================================================================
--- Python-3.15.0a7.orig/Lib/test/test_pyexpat.py       2026-03-24 
11:42:35.793988139 +0100
+++ Python-3.15.0a7/Lib/test/test_pyexpat.py    2026-03-24 11:42:35.928988239 
+0100
@@ -701,6 +701,25 @@
         parser.ElementDeclHandler = lambda _1, _2: None
         self.assertRaises(TypeError, parser.Parse, data, True)
 
+    @support.skip_if_unlimited_stack_size
+    @support.skip_emscripten_stack_overflow()
+    @support.skip_wasi_stack_overflow()
+    def test_deeply_nested_content_model(self):
+        # This should raise a RecursionError and not crash.
+        # See https://github.com/python/cpython/issues/145986.
+        N = 500_000
+        data = (
+            b'<!DOCTYPE root [\n<!ELEMENT root '
+            + b'(a, ' * N + b'a' + b')' * N
+            + b'>\n]>\n<root/>\n'
+        )
+
+        parser = expat.ParserCreate()
+        parser.ElementDeclHandler = lambda _1, _2: None
+        with support.infinite_recursion():
+            with self.assertRaises(RecursionError):
+                parser.Parse(data)
+
 class MalformedInputTest(unittest.TestCase):
     def test1(self):
         xml = b"\0\r\n"
Index: 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
===================================================================
--- /dev/null   1970-01-01 00:00:00.000000000 +0000
+++ 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
    2026-03-24 11:42:35.930068121 +0100
@@ -0,0 +1,4 @@
+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
+converting deeply nested XML content models with
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
+This addresses :cve:`2026-4224`.
Index: Python-3.15.0a7/Modules/pyexpat.c
===================================================================
--- Python-3.15.0a7.orig/Modules/pyexpat.c      2026-03-10 13:31:15.000000000 
+0100
+++ Python-3.15.0a7/Modules/pyexpat.c   2026-03-24 11:42:35.930497962 +0100
@@ -3,6 +3,7 @@
 #endif
 
 #include "Python.h"
+#include "pycore_ceval.h"         // _Py_EnterRecursiveCall()
 #include "pycore_import.h"        // _PyImport_SetModule()
 #include "pycore_pyhash.h"        // _Py_HashSecret
 #include "pycore_traceback.h"     // _PyTraceback_Add()
@@ -607,6 +608,10 @@
 conv_content_model(XML_Content * const model,
                    PyObject *(*conv_string)(void *))
 {
+    if (_Py_EnterRecursiveCall(" in conv_content_model")) {
+        return NULL;
+    }
+
     PyObject *result = NULL;
     PyObject *children = PyTuple_New(model->numchildren);
     int i;
@@ -618,7 +623,7 @@
                                                  conv_string);
             if (child == NULL) {
                 Py_XDECREF(children);
-                return NULL;
+                goto done;
             }
             PyTuple_SET_ITEM(children, i, child);
         }
@@ -626,6 +631,8 @@
                                model->type, model->quant,
                                conv_string, model->name, children);
     }
+done:
+    _Py_LeaveRecursiveCall();
     return result;
 }
 

++++++ CVE-2026-4519-webbrowser-open-dashes.patch ++++++
>From b0fa0748582becb607c337668b1d6e26f51ecdbf Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <[email protected]>
Date: Thu, 15 Jan 2026 10:40:34 -0600
Subject: [PATCH] gh-143930: Reject leading dashes in webbrowser URLs

---
 Lib/test/test_webbrowser.py                                              |    
5 +++
 Lib/webbrowser.py                                                        |   
13 ++++++++++
 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst |    
1 
 3 files changed, 19 insertions(+)
 create mode 100644 
Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst

Index: Python-3.15.0a7/Lib/test/test_webbrowser.py
===================================================================
--- Python-3.15.0a7.orig/Lib/test/test_webbrowser.py    2026-03-27 
18:53:38.418777310 +0100
+++ Python-3.15.0a7/Lib/test/test_webbrowser.py 2026-03-27 18:53:41.404560737 
+0100
@@ -67,6 +67,11 @@
                    options=[],
                    arguments=[URL])
 
+    def test_reject_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaises(ValueError):
+            browser.open(f"--key=val {URL}")
+
 
 class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 
Index: Python-3.15.0a7/Lib/webbrowser.py
===================================================================
--- Python-3.15.0a7.orig/Lib/webbrowser.py      2026-03-27 18:53:38.820702489 
+0100
+++ Python-3.15.0a7/Lib/webbrowser.py   2026-03-27 18:53:41.404779429 +0100
@@ -163,6 +163,12 @@
     def open_new_tab(self, url):
         return self.open(url, 2)
 
+    @staticmethod
+    def _check_url(url):
+        """Ensures that the URL is safe to pass to subprocesses as a 
parameter"""
+        if url and url.lstrip().startswith("-"):
+            raise ValueError(f"Invalid URL: {url}")
+
 
 class GenericBrowser(BaseBrowser):
     """Class for all browsers started with a command
@@ -180,6 +186,7 @@
 
     def open(self, url, new=0, autoraise=True):
         sys.audit("webbrowser.open", url)
+        self._check_url(url)
         cmdline = [self.name] + [arg.replace("%s", url)
                                  for arg in self.args]
         try:
@@ -200,6 +207,7 @@
         cmdline = [self.name] + [arg.replace("%s", url)
                                  for arg in self.args]
         sys.audit("webbrowser.open", url)
+        self._check_url(url)
         try:
             if sys.platform[:3] == 'win':
                 p = subprocess.Popen(cmdline)
@@ -266,6 +274,7 @@
 
     def open(self, url, new=0, autoraise=True):
         sys.audit("webbrowser.open", url)
+        self._check_url(url)
         if new == 0:
             action = self.remote_action
         elif new == 1:
@@ -357,6 +366,7 @@
 
     def open(self, url, new=0, autoraise=True):
         sys.audit("webbrowser.open", url)
+        self._check_url(url)
         # XXX Currently I know no way to prevent KFM from opening a new win.
         if new == 2:
             action = "newTab"
@@ -588,6 +598,7 @@
     class WindowsDefault(BaseBrowser):
         def open(self, url, new=0, autoraise=True):
             sys.audit("webbrowser.open", url)
+            self._check_url(url)
             try:
                 os.startfile(url)
             except OSError:
@@ -608,6 +619,7 @@
 
         def open(self, url, new=0, autoraise=True):
             sys.audit("webbrowser.open", url)
+            self._check_url(url)
             url = url.replace('"', '%22')
             if self.name == 'default':
                 proto, _sep, _rest = url.partition(":")
@@ -664,6 +676,7 @@
     class IOSBrowser(BaseBrowser):
         def open(self, url, new=0, autoraise=True):
             sys.audit("webbrowser.open", url)
+            self._check_url(url)
             # If ctypes isn't available, we can't open a browser
             if objc is None:
                 return False
Index: 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
===================================================================
--- /dev/null   1970-01-01 00:00:00.000000000 +0000
+++ 
Python-3.15.0a7/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
    2026-03-27 18:53:41.405010986 +0100
@@ -0,0 +1 @@
+Reject leading dashes in URLs passed to :func:`webbrowser.open`

++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.9vV1Qm/_old  2026-03-31 15:23:46.884050067 +0200
+++ /var/tmp/diff_new_pack.9vV1Qm/_new  2026-03-31 15:23:46.888050234 +0200
@@ -1,6 +1,6 @@
-mtime: 1774043675
-commit: 3102b45016f8638c4810f1eb1fce60a188f11ff8bdedce73f06a86c13bae5601
+mtime: 1774634044
+commit: 72260269b18eb1203403d94df928332b7b058bbc8e0a73bd1238cd0c5b5eef3e
 url: https://src.opensuse.org/python-interpreters/python315.git
-revision: 3102b45016f8638c4810f1eb1fce60a188f11ff8bdedce73f06a86c13bae5601
+revision: 72260269b18eb1203403d94df928332b7b058bbc8e0a73bd1238cd0c5b5eef3e
 projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj
 

++++++ build.specials.obscpio ++++++
--- old/.gitignore      2026-03-20 22:54:50.000000000 +0100
+++ new/.gitignore      2026-03-27 18:54:41.000000000 +0100
@@ -1,5 +1,4 @@
 *.obscpio
-*.orig
 *.osc
 _build.*
 .pbuild

++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore      1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore      2026-03-27 18:54:41.000000000 +0100
@@ -0,0 +1,5 @@
+*.obscpio
+*.osc
+_build.*
+.pbuild
+python315-*-build/

Reply via email to