Crumb
c/python · by jnovinger@lemmy.ml · 3y

The Right Way to Run Shell Commands From Python | Martin Heinz

https://martinheinz.dev/blog/98

8 points · 2 comments · view on lemmy.world

2 Comments

CosmicGiraffe@lemmy.world · 4 pts · 3y (1 reply)

e.g. shell=True allows you to pass the command as a single string

Don't do this. As the article says its much better to split the string using shlex and avoid the risk of shell injection vulnerabilities.

perpetualmaniac@lemmy.ml · 2 pts · 3y

It's fine for the majority of cases. Shell vulnerabilities exist when you take in user input. If it's a personal project or you are composing the string to pass to the shell without user input then it's perfectly fine.