#2189: PyGRASS Module does not work on Windows
--------------------------+-------------------------------------------------
Reporter: annakrat | Owner: grass-dev@…
Type: defect | Status: closed
Priority: normal | Milestone: 7.0.0
Component: Python | Version: svn-trunk
Resolution: fixed | Keywords: pygrass
Platform: MSWindows 8 | Cpu: Unspecified
--------------------------+-------------------------------------------------
Comment(by glynn):
Replying to [comment:2 annakrat]:
> Python documentation warns against using this but we are using it anyway
in script.py.
The warning in the Python documentation is misleading. It's not that
shell=True is a problem by itself. The problem is shell=True in
combination with passing the command as a string rather than a list, where
the string is dynamically generated.
On Unix, passing the command as a string practically requires shell=True
(passing a string with shell=False will treat the entire string as the
path to an executable, which will be executed without arguments).
As the documentation notes, this combination risks an injection attack. If
a chunk of text which is supposed to be a single argument or part of an
argument contains shell metcharacters (spaces, quotes, etc), it can end up
supplying additional arguments or even additional commands to be executed.
Avoiding the shell and passing the command as a list avoids this problem.
On Windows, the fundamental execution primitive (!CreateProcess) takes a
string rather than a list of strings. A list passed to subprocess.Popen()
is always converted to a string by "inverting" the rules by which MSVCRT
parses the string back to an argument list.
There, the only difference between shell=False and shell=True is that the
latter prepends "cmd.exe /c " to the resulting string (actually, if the
COMSPEC environment variable is set, its value is used in place of
"cmd.exe"). This is the same behaviour as MSVCRT's system() function. The
end result is that shell=True allows you to execute scripts (including
batch files), documents, etc, whereas shell=False only works for binary
executables (execution of scripts is implemented by the shell, rather than
by the kernel as is the case on Unix).
--
Ticket URL: <http://trac.osgeo.org/grass/ticket/2189#comment:6>
GRASS GIS <http://grass.osgeo.org>