Since I use notify-send to show the notify, and there

Escape special characters in the command about wonderful_bing HOT 4 CLOSED

lord63 commented on June 19, 2024

Escape special characters in the command

from wonderful_bing.

Comments (4)

lord63 commented on June 19, 2024

The list: ', ", &, (, ), ;, <, ```, |

from wonderful_bing.

lord63 commented on June 19, 2024

Hey, I found something in the subprocess module documentation, which you can use $pydoc -p 6789 to get them.

Replacing os.system()                                                       
---------------------                                                       
sts = os.system("mycmd" + " myarg") 
==>                                                                         
p = Popen("mycmd" + " myarg", shell=True)
pid, sts = os.waitpid(p.pid, 0)           

Note: 

* Calling the program through the shell is usually not required.

* It's easier to look at the returncode attribute than the
  exitstatus.                                                               

A more real-world example would look like this:

try:                                                                        
    retcode = call("mycmd" + " myarg", shell=True)                          
    if retcode < 0:                                                         
        print >>sys.stderr, "Child was terminated by signal", -retcode
    else:                                                                   
        print >>sys.stderr, "Child returned", retcode
except OSError, e:                             
    print >>sys.stderr, "Execution failed:", e

from wonderful_bing.

lord63 commented on June 19, 2024

It seems that args should be a sequence of program arguments, or a string with shell set to True.

Something about shell=True, get more information from here: Frequently Used Arguments

Warning

Executing shell commands that incorporate unsanitized input from an untrusted source makes a program vulnerable to shell injection, a serious security flaw which can result in arbitrary command execution. For this reason, the use of shell=True is strongly discouraged in cases where the command string is constructed from external input:

from wonderful_bing.

lord63 commented on June 19, 2024

It seems that use a sequence of program arguments as args will be a good idea, you don't have to worry about the special characters(except " if I use "blabla").

>>>subprocess.call(['echo', "Today's Picture Story"])
Today's Picture Story
0
>>> subprocess.call('echo "Today's Picture Story"', shell=True)
  File "<stdin>", line 1
    subprocess.call('echo "Today's Picture Story"', shell=True)
                                 ^
    SyntaxError: invalid syntax
>>> subprocess.call('echo "Today\'s Picture Story"', shell=True)
Today's Picture Story
0

from wonderful_bing.

Recommend Projects