[issue36021] [Security][Windows] webbrowser: WindowsDefault uses os.startfile() and so can be abused to run arbitrary commands

[STINNER Victor]

STINNER Victor <vstin...@redhat.com> added the comment:

PR 11931 experimented other tests:

         return os.path.isfile(path) and os.access(path, os.X_OK)

and:

        is_exe = False
        with open(path, 'rb') as fp:
            s = fp.read(2)
            is_exe = s != b'MZ'
         return os.path.isfile(path) and is_exe

I'm not sure that it's safe. Windows support a wide range of programs: .COM, 
.EXE, .VBS, .BAT, etc. It's hard to get a complete list.

----------

_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue36021>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com