How to avoid Shell Injection with a path variable and wait for command exist?

Question

I need to read the exit of a command (then I have to wait for it in sync way):

import subprocess
subprocess.call('ls ~', shell=True)

My problem is a path like this:

~/testing/;xterm;/blabla

How could I sanitize that string from user (allowing special characters from his language)?

import subprocess
subprocess.call('ls ~/testing/;xterm;/blabla', shell=True) # This will launch xterm

I found escapeshellcmd in PHP, but I didn't find anything in Python.

PS: It's not a duplicate of this:

Because it's the complete path, not the filename.
And I read the os.path and I didn't find a solution.

Thanks in advance!

=======

falsetru · Accepted Answer · 2015-01-17 12:53:34Z

4

Pass a list instead of a string. And remove shell=True to make the command are not run by shell. (You need to expand ~ yourself using os.path.expanduser)

import os
import subprocess

subprocess.call(['ls', os.path.expanduser('~') + '/testing/;xterm;/blabla'])

Side note: If you want to get list of filenames, you'd better to use os.listdir instead:

filelist = os.listdir(os.path.expanduser('~') + '/testing/;xterm;/blabla')

edited Jan 17, 2015 at 12:53

answered Jan 17, 2015 at 12:47

falsetru

371k69 gold badges769 silver badges659 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Costales Over a year ago

Thanks, but I found this problem: without the shell=True, I can't get the exit of the command, filelist is always empty.

falsetru Over a year ago

@costales, It's weird. Could you try this? filelist = os.listdir(os.path.join(os.path.expanduser('~'), 'testing', ';xterm;', 'blabla'))

Padraic Cunningham Over a year ago

I would use check_call unless you want to ignore non zero exit status

Padraic Cunningham Over a year ago

@falsetru, yes that is what I meant.

Costales Over a year ago

@falsetru: Thanks a lot! the os library is solving my issue :)

Collectives™ on Stack Overflow

How to avoid Shell Injection with a path variable and wait for command exist?

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related