webbrowser has no escape for os.pathsep

Bug report

Bug description:

aws-sso-util uses the browser module to open the AWS Identity Center login flow.

Sometimes I need to open the login flow in Firefox using a specific container.

The only way I know to open a specific container in Firefox is to use the open-url-in-container extension. It provides a custom protocol handler to follow a URL in a specific container.

So to open the Identity Center start URL in container ABC123, I'd set the BROWSER variable like this before invoking aws-sso-util login:

export BROWSER="firefox ext+container:name=ABC123&url=%s"

But it doesn't work. Instead aws-sso-util prints an error:

Login failed: Failed to open browser

webbrowser.open_new_tab raises an exception to make it print this. (source code).

The problem seems to be the : character in the protocol handler. The doc says the module handles that as list separator.

If the environment variable BROWSER exists, it is interpreted as the os.pathsep-separated list of browsers to try ahead of the platform defaults. When the value of a list part contains the string %s, then it is interpreted as a literal browser command line to be used with the argument URL substituted for %s; if the part does not contain %s, it is simply interpreted as the name of the browser to launch. [1]

The doc doesn't show any way to escape the :. I've tried \: and :: without any change in behavior.

I also tried URL escaping. This launches the browser, but opens the wrong thing because it no longer recognizes the custom protocol handler.

export BROWSER="firefox ext+container%3Aname=ABC123&url=%s"

Firefox can’t find the file at /project/ext container:name=ABC123&url=https://d-....awsapps.com/start/#/device?user_code=....

CPython versions tested on:

3.10

Operating systems tested on:

No response

Linked PRs

• gh-152474

Start with the webbrowser documentation and the webbrowser.open_new_tab entry point; reproduce the BROWSER value shown with the custom protocol handler. Review the linked work gh-152474 and the reported aws_sso_lib/browser.py call site, then verify that a browser command containing os.pathsep can be passed without being split incorrectly.