Peter Otten wrote:
> Paulo da Silva wrote:
>
>> Em 12-01-2014 20:29, Peter Otten escreveu:
>>> Paulo da Silva wrote:
>>>
>>>>> but I have not tried it myself. Also, some bytes may need to be
>>>>> escaped, either to be understood by the shell, or to address security
>>>>> concerns:
>>>>>
>>>>
>>>> Since I am puting the file names between "", the only char that needs
>>>> to be escaped is the " itself.
>>>
>>> What about the escape char?
>>>
>> Just this fn=fn.replace('"','\\"')
>>
>> So far I didn't find any problem, but the script is still running.
>
> To be a bit more explicit:
>
>>>> for filename in os.listdir():
> ... print(template.replace("<fn>", filename.replace('"', '\\"')))
> ...
> ls "\\"; rm whatever; ls \"
The complete session:
>>> import os
>>> template = 'ls "<fn>"'
>>> with open('\\"; rm whatever; ls \\', "w") as f: pass
...
>>> for filename in os.listdir():
... print(template.replace("<fn>", filename.replace('"', '\\"')))
...
ls "\\"; rm whatever; ls \"
Shell variable substitution is another problem. c.l.py is probably not the
best place to get the complete list of possibilities.
--
https://mail.python.org/mailman/listinfo/python-list
