[pypy-commit] pypy default: Merged in hberaud/pypy/avoid_shell_injection_in_shutil (pull request #628)
arigo
pypy.commits at gmail.com
Mon Sep 24 06:22:56 EDT 2018
Author: Armin Rigo <armin.rigo at gmail.com>
Branch:
Changeset: r95160:496edc03bd13
Date: 2018-09-24 10:22 +0000
http://bitbucket.org/pypy/pypy/changeset/496edc03bd13/
Log: Merged in hberaud/pypy/avoid_shell_injection_in_shutil (pull request
#628)
Use subprocess to Avoid shell injection in shutil module
diff --git a/lib-python/2.7/shutil.py b/lib-python/2.7/shutil.py
--- a/lib-python/2.7/shutil.py
+++ b/lib-python/2.7/shutil.py
@@ -396,17 +396,21 @@
return archive_name
-def _call_external_zip(base_dir, zip_filename, verbose=False, dry_run=False):
+def _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger):
# XXX see if we want to keep an external call here
if verbose:
zipoptions = "-r"
else:
zipoptions = "-rq"
- from distutils.errors import DistutilsExecError
- from distutils.spawn import spawn
+ cmd = ["zip", zipoptions, zip_filename, base_dir]
+ if logger is not None:
+ logger.info(' '.join(cmd))
+ if dry_run:
+ return
+ import subprocess
try:
- spawn(["zip", zipoptions, zip_filename, base_dir], dry_run=dry_run)
- except DistutilsExecError:
+ subprocess.check_call(cmd)
+ except subprocess.CalledProcessError:
# XXX really should distinguish between "couldn't find
# external 'zip' command" and "zip failed".
raise ExecError, \
@@ -440,7 +444,7 @@
zipfile = None
if zipfile is None:
- _call_external_zip(base_dir, zip_filename, verbose, dry_run)
+ _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger)
else:
if logger is not None:
logger.info("creating '%s' and adding '%s' to it",
More information about the pypy-commit
mailing list