Re: Sanitising arguments to shell commands

2009-08-21 Thread Chris Rebert
On Fri, Aug 21, 2009 at 3:55 PM, Ben Finney wrote: > Rick King writes: > >> shlex doesn't handle unicode input though, so, in general, it's not a >> good solution. > > Argh. Is there a Python bug tracker number for fixing that? Indeed there is: http://bugs.python.org/issue1170 It even has a patc

Re: Sanitising arguments to shell commands

2009-08-21 Thread Ben Finney
Rick King writes: > shlex doesn't handle unicode input though, so, in general, it's not a > good solution. Argh. Is there a Python bug tracker number for fixing that? Or is there a better solution? -- \ “Pinky, are you pondering what I'm pondering?” “I think so, | `\ Brain, but if

Re: Sanitising arguments to shell commands

2009-08-21 Thread Rick King
shlex doesn't handle unicode input though, so, in general, it's not a good solution. Rick King Southfield MI http://docs.python.org/library/shlex.html module shlex — Simple lexical analysis New in version 1.5.2. "The shlex class makes it easy to write lexical analyzers for simple syntaxes res

Re: Sanitising arguments to shell commands

2009-08-21 Thread Jean-Michel Pichavant
Ben Finney wrote: Jean-Michel Pichavant writes: Can someone explain the difference with the shell argument ? giving for instance an example of what True will do that False won't. The ‘shell’ argument to the ‘subprocess.Popen’ constructor specifies whether the command-line should be i

Re: Sanitising arguments to shell commands

2009-08-21 Thread Ben Finney
Chris Rebert writes: > module shlex — Simple lexical analysis > New in version 1.5.2. > "The shlex class makes it easy to write lexical analyzers for simple > syntaxes resembling that of the Unix shell." Exactly what I needed: >>> import shlex >>> user_configured_args = "--baz 'crunch cronch' -

Re: Sanitising arguments to shell commands

2009-08-21 Thread Ben Finney
Jean-Michel Pichavant writes: > Can someone explain the difference with the shell argument ? giving > for instance an example of what True will do that False won't. The ‘shell’ argument to the ‘subprocess.Popen’ constructor specifies whether the command-line should be invoked directly (‘shell=Fa

Re: Sanitising arguments to shell commands

2009-08-21 Thread Jean-Michel Pichavant
Ben Finney wrote: Miles Kaufmann writes: I would recommend avoiding shell=True whenever possible. It's used in the examples, I suspect, to ease the transition from the functions being replaced, but all it takes is for a filename or some other input to unexpectedly contain whitespace or a me

Re: Sanitising arguments to shell commands (was: Waiting for a subprocess to exit)

2009-08-21 Thread Chris Rebert
On Fri, Aug 21, 2009 at 2:08 AM, Ben Finney wrote: > How can I take a string that is intended to be part of a command line, > representing multiple arguments and the shell's own escape characters as > in the above example, and end up with a sane command argument list for > ‘subprocess.Popen’? htt

Sanitising arguments to shell commands (was: Waiting for a subprocess to exit)

2009-08-21 Thread Ben Finney
Miles Kaufmann writes: > I would recommend avoiding shell=True whenever possible. It's used in > the examples, I suspect, to ease the transition from the functions > being replaced, but all it takes is for a filename or some other input > to unexpectedly contain whitespace or a metacharacter and