How to sanitize url string in Python?

Question

I have a python app that works with URL lists and produces bash script as an output.

How to sanitize URL so that a malicious user could not inject bash commands that will be executed on my infrastructure.

For instance:

http://www.circl.lu/a.php?rm -Rf /etc

Whether or not you need to sanitize it depends on what you are doing with it. As a simple example, printf '%s\n' "$UNSANITIZED_URL" is completely safe. (Assuming no buffer-overflow bugs or the like in your shell itself.) — chepner
– chepner, Commented Apr 10, 2019 at 13:20
@DirtyBit the bash script is output, I need to sanitize URL in Python — iceone213
– iceone213, Commented Apr 10, 2019 at 13:25
@chepner the output (bash script) may be executed on different systems, so I have no control over it — iceone213
– iceone213, Commented Apr 10, 2019 at 13:31

schilli · Accepted Answer · 2019-04-10 18:43:12Z

7

I guess urllib is an option to parse the urls, in order to escape harmful characters. At least it looks like a good resource for your use case. See the docs of url-quoting.

from urllib.parse import quote

quote('touch foo', safe='/')
quote('rm -Rf /etc', safe='/')
quote('http://www.circl.lu/a.php?rm -Rf /etc', safe='/:?&')

#'touch%20foo'
#'rm%20-Rf%20/etc'
#'http://www.circl.lu/a.php?rm%20-Rf%20/etc'

answered Apr 10, 2019 at 18:43

schilli

1,8581 gold badge12 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to sanitize url string in Python?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related