gh-143930: Reject leading dashes in webbrowser URLs

[sethmlarson]

• Issue: Reject leading dashes in webbrowser.open() #143930

[Yhg1s]

What about / or other common option prefixes?

[sethmlarson]

@Yhg1s I'm concerned that there are use-cases for calling webbrowser.open() on paths, so we'd have to be more cautious in this case. Another option I suggested was to percent-encode spaces?

[gpshead]

on windows a '/' prefix is typically a command line flag - does it actually work as an absolute current drive path on edge/chrome/firefox? to be a url for that it really should be "file://"

[sethmlarson]

Yeah we currently support opening absolute paths via /index.html as a URL. Maybe we want to deprecate this in favor of forcing folks to use file:// but doing so here would result in breakages most likely. Let's move forward with only leading dashes for now.

[miss-islington-app]

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @sethmlarson, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.12

[miss-islington-app]

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.11

[miss-islington-app]

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 82a24a4442312bdcfc4c799885e8b3e00990f02b 3.10