[Python-Dev] subprocess shell=True on Windows doesn't escape ^ character

[Akira Li]

Florian Bruhin <me at the-compiler.org> writes:

> * Nikolaus Rath <Nikolaus at rath.org> [2014-06-12 19:11:07 -0700]:
>> "R. David Murray" <rdmurray at bitdance.com> writes:
>> > Also notice that using a list with shell=True is using the API
>> > incorrectly.  It wouldn't even work on Linux, so that torpedoes
>> > the cross-platform concern already :)
>> >
>> > This kind of confusion is why I opened http://bugs.python.org/issue7839.
>> 
>> Can someone describe an use case where shell=True actually makes sense
>> at all?
>> 
>> It seems to me that whenever you need a shell, the argument's that you
>> pass to it will be shell specific. So instead of e.g.
>> 
>> Popen('for i in `seq 42`; do echo $i; done', shell=True)
>> 
>> you almost certainly want to do
>> 
>> Popen(['/bin/sh', 'for i in `seq 42`; do echo $i; done'], shell=False)
>> 
>> because if your shell happens to be tcsh or cmd.exe, things are going to
>> break.
>
> My usecase is a spawn-command in a GUI application, which the user can
> use to spawn an executable. I want the user to be able to use the
> usual shell features from there. However, I also pass an argument to
> that command, and that should be escaped.

You should pass the command as a string and use cmd.exe quote rules [1]
(note: they are different from the one provided by
`subprocess.list2cmdline()` [2] that follows Microsoft C/C++ startup
code rules [3] e.g., `^` is not special unlike in cmd.exe case).

[1]: http://blogs.msdn.com/b/twistylittlepassagesallalike/archive/2011/04/23/everyone-quotes-arguments-the-wrong-way.aspx

[2]: https://docs.python.org/3.4/library/subprocess.html#converting-an-argument-sequence-to-a-string-on-windows

[3]: http://msdn.microsoft.com/en-us/library/17w5ykft%28v=vs.85%29.aspx


--
akira