On Wed, Dec 21, 2016 at 10:50 PM, <c...@zip.com.au> wrote: > To my mind the more important thing is to use the "shell=False" version of > Popen. os.system() inherently accepts a shell command string, which means > you need to hand quote the /home/path/to/myfile.ods. But it is better to > pass an array of strings: > > ['libreoffice', '--calc', path_value] > > where path_value is a Python variable containing "/home/path/to/myfile.ods" > or whatever the path is. This way you don't need to do anything special for, > um, "unusual" paths because you're not passing the string _through_ the > shell.
Both you and Eryk seem to be speaking in terms of using subprocess.Popen() directly. So I think I need some clarification. At https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module it says: "The recommended approach to invoking subprocesses is to use the run() function for all use cases it can handle. For more advanced use cases, the underlying Popen interface can be used directly. "The run() function was added in Python 3.5; if you need to retain compatibility with older versions, see the Older high-level API section." The OP is using Python 3.4, so that is why I referred him to the "Older high-level API section". Anyway this portion of the docs suggests normally using subprocess.run(). OTOH, for using subprocess.Popen() directly at https://docs.python.org/3/library/subprocess.html#popen-constructor it says: "The underlying process creation and management in this module is handled by the Popen class. It offers a lot of flexibility so that developers are able to handle the less common cases not covered by the convenience functions." My current understanding as to why the subprocess module is preferred to using the older os.system() is to avoid shell injection attacks. So my assumption is that even when using "shell=True" with either run() or Popen(), this is avoided. Is this true? So on to the requested clarification: Are there subtleties as to when to use run() and when to use Popen()? Thanks! -- boB _______________________________________________ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
