Each Answer to this Q is separated by one/two green lines.
When using os.system() it’s often necessary to escape filenames and other arguments passed as parameters to commands. How can I do this? Preferably something that would work on multiple operating systems/shells but in particular for bash.
I’m currently doing the following, but am sure there must be a library function for this, or at least a more elegant/robust/efficient option:
def sh_escape(s): return s.replace("(","\\(").replace(")","\\)").replace(" ","\\ ") os.system("cat %s | grep something | sort > %s" % (sh_escape(in_filename), sh_escape(out_filename)))
Edit: I’ve accepted the simple answer of using quotes, don’t know why I didn’t think of that; I guess because I came from Windows where ‘ and ” behave a little differently.
Regarding security, I understand the concern, but, in this case, I’m interested in a quick and easy solution which os.system() provides, and the source of the strings is either not user-generated or at least entered by a trusted user (me).
This is what I use:
def shellquote(s): return "'" + s.replace("'", "'\\''") + "'"
The shell will always accept a quoted filename and remove the surrounding quotes before passing it to the program in question. Notably, this avoids problems with filenames that contain spaces or any other kind of nasty shell metacharacter.
Update: If you are using Python 3.3 or later, use shlex.quote instead of rolling your own.
Perhaps you have a specific reason for using
os.system(). But if not you should probably be using the
subprocess module. You can specify the pipes directly and avoid using the shell.
The following is from PEP324:
Replacing shell pipe line ------------------------- output=`dmesg | grep hda` ==> p1 = Popen(["dmesg"], stdout=PIPE) p2 = Popen(["grep", "hda"], stdin=p1.stdout, stdout=PIPE) output = p2.communicate()
subprocess.list2cmdline is a better shot?
Note that pipes.quote is actually broken in Python 2.5 and Python 3.1 and not safe to use–It doesn’t handle zero-length arguments.
>>> from pipes import quote >>> args = ['arg1', '', 'arg3'] >>> print 'mycommand %s' % (' '.join(quote(arg) for arg in args)) mycommand arg1 arg3
See Python issue 7476; it has been fixed in Python 2.6 and 3.2 and newer.
I believe that os.system just invokes whatever command shell is configured for the user, so I don’t think you can do it in a platform independent way. My command shell could be anything from bash, emacs, ruby, or even quake3. Some of these programs aren’t expecting the kind of arguments you are passing to them and even if they did there is no guarantee they do their escaping the same way.
Notice: This is an answer for Python 2.7.x.
According to the source,
pipes.quote() is a way to “Reliably quote a string as a single argument for /bin/sh“. (Although it is deprecated since version 2.7 and finally exposed publicly in Python 3.3 as the
On the other hand,
subprocess.list2cmdline() is a way to “Translate a sequence of arguments into a command line string, using the same rules as the MS C runtime“.
Here we are, the platform independent way of quoting strings for command lines.
import sys mswindows = (sys.platform == "win32") if mswindows: from subprocess import list2cmdline quote_args = list2cmdline else: # POSIX from pipes import quote def quote_args(seq): return ' '.join(quote(arg) for arg in seq)
# Quote a single argument print quote_args(['my argument']) # Quote multiple arguments my_args = ['This', 'is', 'my arguments'] print quote_args(my_args)
The function I use is:
def quote_argument(argument): return '"%s"' % ( argument .replace('\\', '\\\\') .replace('"', '\\"') .replace('$', '\\$') .replace('`', '\\`') )
that is: I always enclose the argument in double quotes, and then backslash-quote the only characters special inside double quotes.
On UNIX shells like Bash, you can use
shlex.quote in Python 3 to escape special characters that the shell might interpret, like whitespace and the
import os import shlex os.system("rm " + shlex.quote(filename))
However, this is not enough for security purposes! You still need to be careful that the command argument is not interpreted in unintended ways. For example, what if the filename is actually a path like
os.system("rm " + shlex.quote(filename)) might delete
/etc/passwd when you only expected it to delete filenames found in the current directory! The issue here isn’t with the shell interpreting special characters, it’s that the filename argument isn’t interpreted by the
rm as a simple filename, it’s actually interpreted as a path.
Or what if the valid filename starts with a dash, for example,
-f? It’s not enough to merely pass the escaped filename, you need to disable options using
-- or you need to pass a path that doesn’t begin with a dash like
./-f. The issue here isn’t with the shell interpreting special characters, it’s that the
rm command interprets the argument as a filename or a path or an option if it begins with a dash.
Here is a safer implementation:
if os.sep in filename: raise Exception("Did not expect to find file path separator in file name") os.system("rm -- " + shlex.quote(filename))