Restrict webagg toolbar events to the actual toolbar items

scottshambaugh · scottshambaugh · commit ba73df8aaafa · 2026-03-12T16:28:00.000-06:00
diff --git a/lib/matplotlib/backends/backend_webagg_core.py b/lib/matplotlib/backends/backend_webagg_core.py
@@ -349,8 +349,11 @@ def _handle_key(self, event):
     handle_key_press = handle_key_release = _handle_key
 
     def handle_toolbar_button(self, event):
-        # TODO: Be more suspicious of the input
-        getattr(self.toolbar, event['name'])()
+        name = event['name']
+        allowed = {item[3] for item in self.toolbar.toolitems}
+        if name not in allowed:
+            return
+        getattr(self.toolbar, name)()
 
     def handle_refresh(self, event):
         if self.manager:
diff --git a/lib/matplotlib/tests/test_backend_webagg.py b/lib/matplotlib/tests/test_backend_webagg.py
@@ -4,6 +4,9 @@
 import pytest
 
 import matplotlib.backends.backend_webagg_core
+from matplotlib.backends.backend_webagg_core import (
+    FigureCanvasWebAggCore, NavigationToolbar2WebAgg,
+)
 from matplotlib.testing import subprocess_run_for_testing
 
 
@@ -33,6 +36,25 @@ def test_webagg_core_no_toolbar():
     assert fm._toolbar2_class is None
 
 
+def test_toolbar_button_dispatch_allowlist():
+    """Only declared toolbar items should be dispatched."""
+    fig = MagicMock()
+    canvas = FigureCanvasWebAggCore(fig)
+    canvas.toolbar = MagicMock(spec=NavigationToolbar2WebAgg)
+    canvas.toolbar.toolitems = NavigationToolbar2WebAgg.toolitems
+
+    # Valid toolbar action should be dispatched.
+    canvas.handle_toolbar_button({'name': 'home'})
+    canvas.toolbar.home.assert_called_once()
+
+    # Invalid names should be silently ignored.
+    canvas.toolbar.reset_mock()
+    canvas.handle_toolbar_button({'name': '__init__'})
+    canvas.handle_toolbar_button({'name': 'not_a_real_button'})
+    # No methods should have been called.
+    assert canvas.toolbar.method_calls == []
+
+
 def test_websocket_check_origin():
     """WebSocket should reject cross-origin connections."""
     pytest.importorskip("tornado")
