gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser by secengjeff · Pull Request #146439 · python/cpython

secengjeff · 2026-03-26T01:31:47Z

Replaces the legacy MacOSXOSAScript class (which constructs and executes AppleScript via osascript) with a new MacOS class that uses Apple’s purpose-built /usr/bin/open utility.

The old MacOSXOSAScript class is now deprecated and emits a DeprecationWarning on use.

Motivation

This change is discussed in:

The previous PATH-lookup vulnerability with osascript was addressed in a separate PR. However, use of osascript remains a concern for the following reasons:

Usability Risk
On managed enterprise Macs, EDR/MDM tools (CrowdStrike, SentinelOne, Jamf, Microsoft Defender for Endpoint, etc.) often monitor or restrict osascript due to its abuse in malware and supply-chain attacks. When restrictions apply, webbrowser.open() can fail silently or with unclear errors, breaking a simple, commonly used API.

Security Risk
osascript is a general-purpose scripting interpreter and a classic Living-Off-the-Land binary (LOOBin). It was used on macOS in the Axios npm supply-chain attack (March 31, 2026). Even after the PATH fix, it still requires constructing and executing AppleScript — a more powerful mechanism than needed for the simple task of opening a URL. This unnecessarily increases the standard library’s attack surface and keeps Python dependent on a tool that security teams frequently treat with caution.

Benefits of the New Implementation

Calls /usr/bin/open directly (absolute path) via subprocess.run with a safe argument list, no shell and no scripting interpreter.
For known browsers, uses open -b <bundle-id> (e.g., com.google.Chrome) to explicitly target the intended application.
Safely routes non-HTTP(S) URLs through a browser to avoid unintended OS file-handler behavior.
Improves default browser detection using plistlib.
Maintains full backward compatibility, including support for named browsers (webbrowser.get("chrome"), etc.).
Simplifies the code and reduces reliance on a general-purpose LOOBin.

Changes

Lib/webbrowser.py: New MacOS class, deprecation of MacOSXOSAScript, updated browser registration.
Lib/test/test_webbrowser.py: Tests for the new implementation and deprecation warning.
Doc/library/webbrowser.rst: Documentation updates and deprecation note.

This is a low-risk modernization that improves both reliability in enterprise environments and the overall security posture of the webbrowser module.

References

…ate MacOSXOSAScript Add a new MacOSX class that opens URLs via subprocess.run(['/usr/bin/open', ...]) instead of piping AppleScript to osascript. For named browsers, /usr/bin/open -a <name> is used; for the default browser, /usr/bin/open <url> defers directly to the OS URL handler. MacOSXOSAScript is deprecated with a DeprecationWarning pointing users to MacOSX. register_standard_browsers() is updated to use MacOSX for all macOS registrations. osascript is a general-purpose scripting interpreter that is routinely blocked on managed endpoints due to its abuse potential, causing webbrowser.open() to fail silently. /usr/bin/open is Apple's purpose-built URL-opening primitive and carries no such restrictions. This also eliminates the PATH-injection vector in the existing os.popen("osascript", "w") call.

…pt deprecation Add MacOSXTest covering default browser open, named browser open, and failure case (non-zero returncode). Add MacOSXOSAScriptDeprecationTest verifying that instantiating MacOSXOSAScript emits a DeprecationWarning. All tests mock subprocess.run.

bedevere-app · 2026-03-26T01:31:52Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

python-cla-bot · 2026-03-26T01:31:52Z

All commit authors signed the Contributor License Agreement.

…press Sphinx lookup

- Add test_default to MacOSXTest asserting webbrowser.get() returns MacOSX - Remove test_default from MacOSXOSAScriptTest (no longer the registered default) - Suppress DeprecationWarning in MacOSXOSAScriptTest setUp and test_explicit_browser using warnings.catch_warnings() so tests for OSAScript behaviour still run cleanly - Add warnings import

…ia OS handler For non-http(s) URLs (e.g. file://), /usr/bin/open dispatches via the OS file handler, which would launch an .app bundle rather than open it in a browser. Fix this by routing non-http(s) URLs through the browser explicitly using /usr/bin/open -b <bundle-id>. Named browsers use a static bundle ID map (Chrome, Firefox, Safari, Chromium, Opera, Edge). Unknown named browsers fall back to -a. For the default browser, the bundle ID is resolved at runtime via the Objective-C runtime using NSWorkspace.URLForApplicationToOpenURL, the same lookup MacOSXOSAScript performed via AppleScript. Falls back to direct open if ctypes is unavailable. http/https URLs with the default browser continue to use /usr/bin/open directly, as macOS always routes these to the registered browser.

…ult_browser_bundle_id NSWorkspace is an AppKit class and is not registered in the ObjC runtime until AppKit is loaded. Without the explicit LoadLibrary call, objc_getClass returns nil for NSWorkspace, causing the entire lookup to silently fall back to /usr/bin/open without -b.

gpshead · 2026-04-05T22:49:23Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Suggested change

.. deprecated:: 3.14

.. deprecated:: next

And precede this deprecated block with a versionadded for the new class, and move both after versionchanged:: 3.13 below.

Also the MacOSXOSAScripts in the table above need updating, and should we also add chrome and firefox (with note (3)) as also returning the new class?

ronaldoussoren

I'm not sure about this PR.

The direct security issue can be fixed by changing the invocation of osascript to /usr/bin/osascript. Blocking osascript while allowing usage of Python is IMHO security theatre.

On modernist systems (macOS 10.15 or later) it is probably possible to just use NSWorkspace directly: it has all the moving peaces to implement what we need for webbrowser.open although I haven't thought through the implications of doing this yet. In particular, -[NSWorkpace openURLs:withApplicationAtURL:configuration:completionHandler:] is asynchronous which makes it harder to report errors.

ronaldoussoren · 2026-04-06T08:38:18Z

Lib/webbrowser.py

 #

 if sys.platform == 'darwin':
+    def _macos_default_browser_bundle_id():


This function leaks memory due to not performing objective-c reference count updates.

Also: This introduces a new dependency on an Apple system framework, which in the past has caused problems for folks starting new worker processes using os.fork (without exec-in a new executable).

Agreed that hardcoding /usr/bin/osascript addresses the PATH injection issue directly. This PR is intended as an incremental improvement on top of that.

The core motivation is that osascript is increasingly blocked at the EDR/MDM level in enterprise environments as a broad response to ClickFix campaigns and supply chain attacks like the axios incident. /usr/bin/open is both incrementally safer as a purpose-built URL dispatch primitive and far less likely to be subject to those same restrictions. When osascript is blocked, users of Python-based tools may see a failure with no obvious connection to osascript, and the path to diagnosing an endpoint security policy conflict is not straightforward for most users.

On _macos_default_browser_bundle_id(): agreed, I'll fix the missing Objective-C reference count cleanup and address the os.fork() concern.

Ended up replacing the AppKit/ctypes implementation with a plistlib read of the LaunchServices preferences file to address the memory and forking risks.

bedevere-app · 2026-04-06T08:59:11Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

hugovk · 2026-04-06T06:32:52Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Suggested change

.. deprecated:: 3.14

.. deprecated:: next

And precede this deprecated block with a versionadded for the new class, and move both after versionchanged:: 3.13 below.

Lib/webbrowser.py

hugovk · 2026-04-06T08:50:27Z

Doc/library/webbrowser.rst

 (4)
   Only on iOS.

+.. deprecated:: 3.14


Also the MacOSXOSAScripts in the table above need updating, and should we also add chrome and firefox (with note (3)) as also returning the new class?

hugovk · 2026-04-06T09:12:03Z

Lib/webbrowser.py

+            'firefox':        'org.mozilla.firefox',
+            'safari':         'com.apple.Safari',
+            'chromium':       'org.chromium.Chromium',
+            'opera':          'com.operasoftware.Opera',


I have Opera installed on macOS, and confirm this is the correct bundle ID in the plist, but whilst this works:

import webbrowser web = webbrowser.get("firefox") web.open("https://www.python.org/")

This doesn't:

import webbrowser web = webbrowser.get("opera") web.open("https://www.python.org/")

Traceback (most recent call last): File "/Users/hugo/github/python/cpython/main/1.py", line 2, in <module> web = webbrowser.get("opera") File "/Users/hugo/github/python/cpython/main/Lib/webbrowser.py", line 68, in get raise Error("could not locate runnable browser") webbrowser.Error: could not locate runnable browser

Do these new ones need registering too, or removing from here?

Thank you for catching this. I registered the browsers and fixed the Edge bundle. Tested both Opera and Edge locally.

…_standard_browsers on macOS These browsers were present in MacOSX._BUNDLE_IDS but not registered, causing webbrowser.get("opera") etc. to raise Error: could not locate runnable browser. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

….edgemac)

…ib to address memory and os.fork() concerns

…irectives

…endict release

…t rename

secengjeff · 2026-04-06T21:21:50Z

I have made the requested changes; please review again

bedevere-app · 2026-04-06T21:22:25Z

Thanks for making the requested changes!

@ronaldoussoren: please review the changes made to this pull request.

secengjeff added 3 commits March 25, 2026 18:31

pythongh-137586: Document MacOSXOSAScript deprecation in webbrowser docs

7781033

bedevere-app bot mentioned this pull request Mar 26, 2026

Use absolute paths when invoking built-in shell commands #137586

Open

bedevere-app bot added the awaiting review label Mar 26, 2026

secengjeff mentioned this pull request Mar 26, 2026

gh-137586: Open external osascript program with absolute path #137584

Merged

secengjeff changed the title ~~gh-137586: Replace MacOSXOSAScript with MacOSX on macOS, using /usr/bin/open~~ gh-137586: Replace 'osascript' with 'open' on macOS Mar 26, 2026

secengjeff added 5 commits March 25, 2026 18:42

pythongh-137586: Add NEWS entries for MacOSX webbrowser change

6066221

pythongh-137586: Fix NEWS entry class references with ! prefix to sup…

d54293f

…press Sphinx lookup

vstinner changed the title ~~gh-137586: Replace 'osascript' with 'open' on macOS~~ gh-137586: Replace 'osascript' with 'open' on macOS in webbrowser Mar 27, 2026

gpshead reviewed Apr 5, 2026

View reviewed changes

gpshead requested a review from ned-deily April 5, 2026 22:51

ned-deily requested review from a team and ronaldoussoren April 6, 2026 00:19

ronaldoussoren requested changes Apr 6, 2026

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting review labels Apr 6, 2026

hugovk reviewed Apr 6, 2026

View reviewed changes

merwok added type-feature A feature request or enhancement OS-mac labels Apr 6, 2026

secengjeff and others added 4 commits April 6, 2026 09:22

pythongh-137586: Fix Microsoft Edge bundle ID on macOS (com.microsoft…

98dd1d8

….edgemac)

pythongh-137586: Replace _macos_default_browser_bundle_id with plistl…

bdfc2e6

…ib to address memory and os.fork() concerns

pythongh-137586: Rename MacOSX to MacOS

614078f

secengjeff added 4 commits April 6, 2026 11:19

pythongh-137586: Use frozendict for MacOS._BUNDLE_IDS

c77f4b8

pythongh-137586: Update webbrowser.rst for MacOS class, fix version d…

c725927

…irectives

pythongh-137586: Revert frozendict for MacOS._BUNDLE_IDS pending froz…

1316dbf

…endict release

pythongh-137586: Fix MacOSXOSAScript mangled to MacOSOSAScript in tes…

612d276

…t rename

bedevere-app bot added awaiting change review and removed awaiting changes labels Apr 6, 2026

bedevere-app bot requested a review from ronaldoussoren April 6, 2026 21:22

secengjeff requested review from gpshead and hugovk April 10, 2026 03:01

secengjeff mentioned this pull request Apr 12, 2026

Security and usability improvement for webbrowser.open() on macOS: Replace osascript with /usr/bin/open #148472

Closed

Uh oh!

Conversation

secengjeff commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Benefits of the New Implementation

Changes

Uh oh!

bedevere-app bot commented Mar 26, 2026

Uh oh!

python-cla-bot bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ronaldoussoren left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Apr 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

secengjeff commented Apr 6, 2026

Uh oh!

bedevere-app bot commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

secengjeff commented Mar 26, 2026 •

edited

Loading

python-cla-bot bot commented Mar 26, 2026 •

edited

Loading