subprocess module usage

Earl Lapus earl.lapus at
Mon Sep 1 08:33:15 CEST 2014

On Mon, Sep 1, 2014 at 1:39 PM, Chris Angelico <rosuav at> wrote:
> Glad it's working! But please, don't just take my word for it and make
> a black-box change to your code. When you invoke subprocesses, be sure
> you understand what's going on, and when shell=True is appropriate and
> when shell=False is appropriate. The docs should be fairly clear on
> this. If you get this sort of thing wrong, you'll get weird errors
> like this (if you're lucky), or open yourself up to shell injection
> vulnerabilities (if you're not).

The command and arguments that will be passed to check_output will not
depend on user input. So, the chances of malicious commands from being
executed would be low (right?).
What I'm really after is just to execute a specific command and 1)
retrieve it's output (if any) 2) detect any error returned while
executing the command. Anyway, I'll take your advise and review the
documentation again.


There are seven words in this sentence.

More information about the Python-list mailing list