Greg's suggestions

Author: StanFromIreland

Lib/test/test_webbrowser.py

@@ -120,6 +120,10 @@ def test_reject_action_dash_prefixes(self):
         browser = self.browser_class(name=CMD_NAME)
         with self.assertRaises(ValueError):
             browser.open('%action--incognito')
+        # new=1: action is "--new-window", so "%action" itself expands to
+        # a dash-prefixed flag even with no dash in the original URL.
+        with self.assertRaises(ValueError):
+            browser.open('%action', new=1)
 
 
 class EdgeCommandTest(CommandTestMixin, unittest.TestCase):

Lib/webbrowser.py

@@ -289,7 +289,7 @@ def open(self, url, new=0, autoraise=True):
 
         self._check_url(url.replace("%action", action))
 
-        args = [arg.replace("%s", url).replace("%action", action)
+        args = [arg.replace("%action", action).replace("%s", url)
                 for arg in self.remote_args]
         args = [arg for arg in args if arg]
         success = self._invoke(args, True, autoraise, url)