[Python-checkins] r86421 - in python/branches/release27-maint: Doc/library/subprocess.rst
python-checkins at python.org
Fri Nov 12 01:39:09 CET 2010
Date: Fri Nov 12 01:39:09 2010
New Revision: 86421
Merged revisions 86419 via svnmerge from
r86419 | r.david.murray | 2010-11-11 19:35:31 -0500 (Thu, 11 Nov 2010) | 4 lines
#7950: add warning about security implications of shell=True to subprocess docs
Patch by Chris Rebert.
python/branches/release27-maint/ (props changed)
--- python/branches/release27-maint/Doc/library/subprocess.rst (original)
+++ python/branches/release27-maint/Doc/library/subprocess.rst Fri Nov 12 01:39:09 2010
@@ -81,6 +81,24 @@
Popen(['/bin/sh', '-c', args, args, ...])
+ .. warning::
+ Executing shell commands that incorporate unsanitized input from an
+ untrusted source makes a program vulnerable to `shell injection
+ a serious security flaw which can result in arbitrary command execution.
+ For this reason, the use of *shell=True* is **strongly discouraged** in cases
+ where the command string is constructed from external input::
+ >>> from subprocess import call
+ >>> filename = input("What file would you like to display?\n")
+ What file would you like to display?
+ non_existent; rm -rf / #
+ >>> call("cat " + filename, shell=True) # Uh-oh. This will end badly...
+ *shell=False* does not suffer from this vulnerability; the above Note may be
+ helpful in getting code using *shell=False* to work.
On Windows: the :class:`Popen` class uses CreateProcess() to execute the child
program, which operates on strings. If *args* is a sequence, it will be
converted to a string using the :meth:`list2cmdline` method. Please note that
More information about the Python-checkins