[New-bugs-announce] [issue34540] shutil._call_external_zip should use subprocess

[Benjamin Peterson]

New submission from Benjamin Peterson <benjamin at python.org>:

disutils.spawn isn't very good at quoting command lines (#8987). We need to use subprocess to avoid shell injection.

----------
components: Library (Lib)
messages: 324301
nosy: benjamin.peterson
priority: normal
severity: normal
status: open
title: shutil._call_external_zip should use subprocess
versions: Python 2.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue34540>
_______________________________________