mike meyer tlfmiredorg tue 22 apr 2008 165242 0300 facundo batista wrote 2008422 andrew mcnabb heres really simple example bash c filetmpa b c cat file thats pretty simple list arguments single string get bash c filetmpa b c cat file get much worse especially need use backslashes think force write tuple list case id need write string uses simple double quotes backslashes ugly dont worth ugly safe growing possibility write tuplelist string string use could say writing plain string incur risk enclosing parameters correctly bash level note youre still quote enclosing even tuplelist python normally treats programmer adult two cases really different pass string shell parse string list strings hand exec allowing hostile user use data injection attacks kinds nasty things unless youre careful getting right hard pass list tuple strings involved passed exec dont figure get shell parse string list actually want worry shell treating something thought data executable code least unless execing shell pretty much killing data injection attacks basically unless youre using relatively simple fixed string right way write list tuple strings making popen act set shelltrue handed single string might desirable cant tell said string constant string buggy cat filename whereas cat filename isnt buggy nature bug allows hostile users get shell execute arbitrary code enough justify making case easier already httpwwwmiredorgconsultinghtml independent networkunixperforce consultant email information _______________________________________________ python3000 mailing list smsbmo9552pythonorg httpmailpythonorgmailmanlistinfopython3000 unsubscribe httpmailpythonorgmailmanoptionspython3000python300040tangomucom thu 07 aug 2008 173807 0400 python3000 ospopen versus subprocesspopen