gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser by secengjeff · Pull Request #146439 · python/cpython

secengjeff · 2026-03-26T01:31:47Z

Replaces MacOSXOSAScript, which pipes AppleScript to osascript, with a new MacOSX class that calls /usr/bin/open directly via subprocess.run. MacOSXOSAScript is deprecated with a DeprecationWarning pointing users to MacOSX.

Why

osascript is a general-purpose AppleScript interpreter and a known LOObin (Living Off the Land binary). Because it can execute arbitrary code, it is routinely blocked by endpoint security tooling on managed Macs. This causes webbrowser.open() to break for users of any Python application that depends on the webbrowser library, with no obvious connection to osascript as the cause.

/usr/bin/open is Apple's purpose-built URL-opening primitive. It passes the URL directly to the OS-registered URL handler with no scripting interpreter involved, and is not subject to the same endpoint security restrictions.

Security

This fixes gh-137586. The existing os.popen("osascript", "w") call resolves via PATH, creating a PATH-injection vector. The open PR for that issue (#137584) proposes switching to /usr/bin/osascript; this change eliminates the dependency entirely.

File injection safety

/usr/bin/open <url> dispatches via the OS file handler, which means a file:// URL pointing to an .app bundle or installer would launch it rather than open it in a browser. To prevent this, non-http(s) URLs are routed through the browser explicitly using /usr/bin/open -b <bundle-id>, ensuring the URL is always handled by a browser regardless of scheme.

Named browsers use a static bundle ID map for common browsers (com.google.Chrome, org.mozilla.firefox, com.apple.Safari, etc.). Unknown named browsers fall back to -a. For the default browser, the bundle ID is resolved at runtime via the Objective-C runtime using the same NSWorkspace.URLForApplicationToOpenURL lookup that MacOSXOSAScript performed via AppleScript, with a graceful fallback to direct open if ctypes is unavailable.

Named browser support

MacOSXOSAScript used tell application "<name>" to target specific browsers. MacOSX preserves this with /usr/bin/open -b <bundle-id> for known browsers and /usr/bin/open -a <name> for others.

Testing

Tested locally on macOS with the default browser and named browsers (Safari, Chrome). Unit tests added covering: default http/https open, non-http URL bundle ID routing, bundle ID lookup fallback, named browser with known bundle ID, named browser fallback to -a, failure case, and the deprecation warning.

Changes

Lib/webbrowser.py: add _macos_default_browser_bundle_id(), add MacOSX with bundle ID map, deprecate MacOSXOSAScript, update register_standard_browsers()
Lib/test/test_webbrowser.py: add MacOSXTest and MacOSXOSAScriptDeprecationTest
Doc/library/webbrowser.rst: add .. deprecated:: 3.14 entry for MacOSXOSAScript

Fixes gh-137586.

…ate MacOSXOSAScript Add a new MacOSX class that opens URLs via subprocess.run(['/usr/bin/open', ...]) instead of piping AppleScript to osascript. For named browsers, /usr/bin/open -a <name> is used; for the default browser, /usr/bin/open <url> defers directly to the OS URL handler. MacOSXOSAScript is deprecated with a DeprecationWarning pointing users to MacOSX. register_standard_browsers() is updated to use MacOSX for all macOS registrations. osascript is a general-purpose scripting interpreter that is routinely blocked on managed endpoints due to its abuse potential, causing webbrowser.open() to fail silently. /usr/bin/open is Apple's purpose-built URL-opening primitive and carries no such restrictions. This also eliminates the PATH-injection vector in the existing os.popen("osascript", "w") call.

…pt deprecation Add MacOSXTest covering default browser open, named browser open, and failure case (non-zero returncode). Add MacOSXOSAScriptDeprecationTest verifying that instantiating MacOSXOSAScript emits a DeprecationWarning. All tests mock subprocess.run.

bedevere-app · 2026-03-26T01:31:52Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

python-cla-bot · 2026-03-26T01:31:52Z

All commit authors signed the Contributor License Agreement.

…press Sphinx lookup

- Add test_default to MacOSXTest asserting webbrowser.get() returns MacOSX - Remove test_default from MacOSXOSAScriptTest (no longer the registered default) - Suppress DeprecationWarning in MacOSXOSAScriptTest setUp and test_explicit_browser using warnings.catch_warnings() so tests for OSAScript behaviour still run cleanly - Add warnings import

…ia OS handler For non-http(s) URLs (e.g. file://), /usr/bin/open dispatches via the OS file handler, which would launch an .app bundle rather than open it in a browser. Fix this by routing non-http(s) URLs through the browser explicitly using /usr/bin/open -b <bundle-id>. Named browsers use a static bundle ID map (Chrome, Firefox, Safari, Chromium, Opera, Edge). Unknown named browsers fall back to -a. For the default browser, the bundle ID is resolved at runtime via the Objective-C runtime using NSWorkspace.URLForApplicationToOpenURL, the same lookup MacOSXOSAScript performed via AppleScript. Falls back to direct open if ctypes is unavailable. http/https URLs with the default browser continue to use /usr/bin/open directly, as macOS always routes these to the registered browser.

…ult_browser_bundle_id NSWorkspace is an AppKit class and is not registered in the ObjC runtime until AppKit is loaded. Without the explicit LoadLibrary call, objc_getClass returns nil for NSWorkspace, causing the entire lookup to silently fall back to /usr/bin/open without -b.

gpshead · 2026-04-05T22:49:23Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Suggested change

.. deprecated:: 3.14

.. deprecated:: next

And precede this deprecated block with a versionadded for the new class, and move both after versionchanged:: 3.13 below.

Also the MacOSXOSAScripts in the table above need updating, and should we also add chrome and firefox (with note (3)) as also returning the new class?

ronaldoussoren

I'm not sure about this PR.

The direct security issue can be fixed by changing the invocation of osascript to /usr/bin/osascript. Blocking osascript while allowing usage of Python is IMHO security theatre.

On modernist systems (macOS 10.15 or later) it is probably possible to just use NSWorkspace directly: it has all the moving peaces to implement what we need for webbrowser.open although I haven't thought through the implications of doing this yet. In particular, -[NSWorkpace openURLs:withApplicationAtURL:configuration:completionHandler:] is asynchronous which makes it harder to report errors.

ronaldoussoren · 2026-04-06T08:38:18Z

Lib/webbrowser.py

 #

 if sys.platform == 'darwin':
+    def _macos_default_browser_bundle_id():


This function leaks memory due to not performing objective-c reference count updates.

Also: This introduces a new dependency on an Apple system framework, which in the past has caused problems for folks starting new worker processes using os.fork (without exec-in a new executable).

Agreed that hardcoding /usr/bin/osascript addresses the PATH injection issue directly. This PR is intended as an incremental improvement on top of that.

The core motivation is that osascript is increasingly blocked at the EDR/MDM level in enterprise environments as a broad response to ClickFix campaigns and supply chain attacks like the axios incident. /usr/bin/open is both incrementally safer as a purpose-built URL dispatch primitive and far less likely to be subject to those same restrictions. When osascript is blocked, users of Python-based tools may see a failure with no obvious connection to osascript, and the path to diagnosing an endpoint security policy conflict is not straightforward for most users.

On _macos_default_browser_bundle_id(): agreed, I'll fix the missing Objective-C reference count cleanup and address the os.fork() concern.

Ended up replacing the AppKit/ctypes implementation with a plistlib read of the LaunchServices preferences file to address the memory and forking risks.

bedevere-app · 2026-04-06T08:59:11Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

hugovk · 2026-04-06T06:32:52Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Suggested change

.. deprecated:: 3.14

.. deprecated:: next

And precede this deprecated block with a versionadded for the new class, and move both after versionchanged:: 3.13 below.

Lib/webbrowser.py

hugovk · 2026-04-06T08:50:27Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Also the MacOSXOSAScripts in the table above need updating, and should we also add chrome and firefox (with note (3)) as also returning the new class?

hugovk · 2026-04-06T09:12:03Z

Lib/webbrowser.py

+            'firefox':        'org.mozilla.firefox',
+            'safari':         'com.apple.Safari',
+            'chromium':       'org.chromium.Chromium',
+            'opera':          'com.operasoftware.Opera',


I have Opera installed on macOS, and confirm this is the correct bundle ID in the plist, but whilst this works:

import webbrowser web = webbrowser.get("firefox") web.open("https://www.python.org/")

This doesn't:

import webbrowser web = webbrowser.get("opera") web.open("https://www.python.org/")

Traceback (most recent call last): File "/Users/hugo/github/python/cpython/main/1.py", line 2, in <module> web = webbrowser.get("opera") File "/Users/hugo/github/python/cpython/main/Lib/webbrowser.py", line 68, in get raise Error("could not locate runnable browser") webbrowser.Error: could not locate runnable browser

Do these new ones need registering too, or removing from here?

Thank you for catching this. I registered the browsers and fixed the Edge bundle. Tested both Opera and Edge locally.

…_standard_browsers on macOS These browsers were present in MacOSX._BUNDLE_IDS but not registered, causing webbrowser.get("opera") etc. to raise Error: could not locate runnable browser. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

….edgemac)

…ib to address memory and os.fork() concerns

…irectives

…endict release

…t rename

secengjeff · 2026-04-06T21:21:50Z

I have made the requested changes; please review again

bedevere-app · 2026-04-06T21:22:25Z

Thanks for making the requested changes!

@ronaldoussoren: please review the changes made to this pull request.

secengjeff added 3 commits March 25, 2026 18:31

pythongh-137586: Document MacOSXOSAScript deprecation in webbrowser docs

7781033

bedevere-app bot mentioned this pull request Mar 26, 2026

Use absolute paths when invoking built-in shell commands #137586

Open

bedevere-app bot added the awaiting review label Mar 26, 2026

secengjeff mentioned this pull request Mar 26, 2026

gh-137586: Open external osascript program with absolute path #137584

Merged

secengjeff changed the title ~~gh-137586: Replace MacOSXOSAScript with MacOSX on macOS, using /usr/bin/open~~ gh-137586: Replace 'osascript' with 'open' on macOS Mar 26, 2026

secengjeff added 5 commits March 25, 2026 18:42

pythongh-137586: Add NEWS entries for MacOSX webbrowser change

6066221

pythongh-137586: Fix NEWS entry class references with ! prefix to sup…

d54293f

…press Sphinx lookup

vstinner changed the title ~~gh-137586: Replace 'osascript' with 'open' on macOS~~ gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser Mar 27, 2026

gpshead reviewed Apr 5, 2026

View reviewed changes

gpshead requested a review from ned-deily April 5, 2026 22:51

ned-deily requested review from a team and ronaldoussoren April 6, 2026 00:19

ronaldoussoren requested changes Apr 6, 2026

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting review labels Apr 6, 2026

hugovk reviewed Apr 6, 2026

View reviewed changes

merwok added type-feature A feature request or enhancement OS-mac labels Apr 6, 2026

secengjeff and others added 4 commits April 6, 2026 09:22

pythongh-137586: Fix Microsoft Edge bundle ID on macOS (com.microsoft…

98dd1d8

….edgemac)

pythongh-137586: Replace _macos_default_browser_bundle_id with plistl…

bdfc2e6

…ib to address memory and os.fork() concerns

pythongh-137586: Rename MacOSX to MacOS

614078f

secengjeff added 4 commits April 6, 2026 11:19

pythongh-137586: Use frozendict for MacOS._BUNDLE_IDS

c77f4b8

pythongh-137586: Update webbrowser.rst for MacOS class, fix version d…

c725927

…irectives

pythongh-137586: Revert frozendict for MacOS._BUNDLE_IDS pending froz…

1316dbf

…endict release

pythongh-137586: Fix MacOSXOSAScript mangled to MacOSOSAScript in tes…

612d276

…t rename

bedevere-app bot added awaiting change review and removed awaiting changes labels Apr 6, 2026

bedevere-app bot requested a review from ronaldoussoren April 6, 2026 21:22

Uh oh!

Conversation

secengjeff commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-app bot commented Mar 26, 2026

Uh oh!

python-cla-bot bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ronaldoussoren left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Apr 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

secengjeff commented Apr 6, 2026

Uh oh!

bedevere-app bot commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

secengjeff commented Mar 26, 2026 •

edited

Loading

python-cla-bot bot commented Mar 26, 2026 •

edited

Loading