[issue33515] subprocess.Popen on a Windows batch file always acts as if shell=True

Change by Eryk Sun : -- stage: patch review -> versions: +Python 3.10, Python 3.9 -Python 2.7, Python 3.6, Python 3.7 ___ Python tracker ___

[issue33515] subprocess.Popen on a Windows batch file always acts as if shell=True

Change by Sergey G. Brester : -- keywords: +patch pull_requests: +8375 stage: needs patch -> patch review ___ Python tracker ___

[issue33515] subprocess.Popen on a Windows batch file always acts as if shell=True

Eryk Sun added the comment: There's no simple workaround for this behavior. All we can reasonably do is document that running a batch script directly has the same security risks as using shell=True. CMD doesn't support a file argument. It only supports running a /c or /k

[issue33515] subprocess.Popen on a Windows batch file always acts as if shell=True

New submission from Abigail : It's possible to invoke an application without interpreting any of its arguments as shell magic: >>> print(subprocess.check_output(["C:/testapplication.exe", "foo", "&&", >>> "echo", "%PROGRAMFILES%"])) Hello world from application! 5