From: Łukasz Langa <lukasz@langa.pl>
Date: Fri, 3 Apr 2026 15:31:25 +0000 (+0200)
Subject: gh-143930: Tweak the exception message and increase test coverage (GH-146476)
X-Git-Tag: v3.15.0a8~58
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3681d47a440865aead912a054d4599087b4270dd;p=thirdparty%2FPython%2Fcpython.git

gh-143930: Tweak the exception message and increase test coverage (GH-146476)
---

diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
index d5bb1400d271..ea161ea1a43e 100644
--- a/Lib/test/test_webbrowser.py
+++ b/Lib/test/test_webbrowser.py
@@ -57,6 +57,14 @@ class CommandTestMixin:
             popen_args.pop(popen_args.index(option))
         self.assertEqual(popen_args, arguments)
 
+    def test_reject_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaisesRegex(
+            ValueError,
+            r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
+        ):
+            browser.open(f"--key=val {URL}")
+
 
 class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 
@@ -67,11 +75,6 @@ class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
                    options=[],
                    arguments=[URL])
 
-    def test_reject_dash_prefixes(self):
-        browser = self.browser_class(name=CMD_NAME)
-        with self.assertRaises(ValueError):
-            browser.open(f"--key=val {URL}")
-
 
 class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
 
@@ -326,7 +329,6 @@ class MockPopenPipe:
 @unittest.skipUnless(sys.platform == "darwin", "macOS specific test")
 @requires_subprocess()
 class MacOSXOSAScriptTest(unittest.TestCase):
-
     def setUp(self):
         # Ensure that 'BROWSER' is not set to 'open' or something else.
         # See: https://github.com/python/cpython/issues/131254.
@@ -376,6 +378,13 @@ class MacOSXOSAScriptTest(unittest.TestCase):
         self.assertIn('tell application "safari"', script)
         self.assertIn('open location "https://python.org"', script)
 
+    def test_reject_dash_prefixes(self):
+        with self.assertRaisesRegex(
+            ValueError,
+            r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
+        ):
+            self.browser.open(f"--key=val {URL}")
+
 
 class BrowserRegistrationTest(unittest.TestCase):
 
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
index 9ead2990e818..deb6e64d1742 100644
--- a/Lib/webbrowser.py
+++ b/Lib/webbrowser.py
@@ -167,7 +167,7 @@ class BaseBrowser:
     def _check_url(url):
         """Ensures that the URL is safe to pass to subprocesses as a parameter"""
         if url and url.lstrip().startswith("-"):
-            raise ValueError(f"Invalid URL: {url}")
+            raise ValueError(f"Invalid URL (leading dash disallowed): {url!r}")
 
 
 class GenericBrowser(BaseBrowser):
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
index 0f27eae99a0d..c561023c3c2d 100644
--- a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
@@ -1 +1 @@
-Reject leading dashes in URLs passed to :func:`webbrowser.open`
+Reject leading dashes in URLs passed to :func:`webbrowser.open`.