commit ecfecc2d6ce88ae71c783f0465a508c6a1b2f2b6
author Serhiy Storchaka <storchaka@gmail.com> Thu Jul 02 10:05:16 2020 +0300
committer GitHub <noreply@github.com> Thu Jul 02 10:05:16 2020 +0300
tree 15fe925d7c2eed5f56154f68971a5883870d5841
parent df59293bf0d815fe37743025d639a63a78e0c771

[3.9] bpo-41043: Escape literal part of the path for glob(). (GH-20994). (GH-21275)

(cherry picked from commit 935586845815f5b4c7814794413f6a812d4bd45f)

Lib/webbrowser.py

diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
index 53e0efc..cea9130 100755
--- a/Lib/webbrowser.py
+++ b/Lib/webbrowser.py
@@ -413,7 +413,7 @@
         tempdir = os.path.join(tempfile.gettempdir(),
                                ".grail-unix")
         user = pwd.getpwuid(os.getuid())[0]
-        filename = os.path.join(tempdir, user + "-*")
+        filename = os.path.join(glob.escape(tempdir), glob.escape(user) + "-*")
         maybes = glob.glob(filename)
         if not maybes:
             return None