[Python-Dev] subprocess not escaping "^" on Windows

[Steve Dower]

Quoting the /c and /k values to cmd.exe is... complicated, to say the least. I struggle to get it right for a single example, let alone generalising it. The /s option also has an impact – sometimes it helps you avoid double-escaping everything, but not always.

Writing complex shell=True commands to a temporary batch file and executing that is more reliable wrt quoting, though now you'd need somewhere writable and executable on disk, which is becoming hard to come by.

Considering there is no cross-platform compatibility here anyway, I don’t think it’s that bad an option to let users do their own escaping, especially since those who are successfully using this feature already do.

Cheers,
Steve

Top-posted from my Windows phone

From: Guido van Rossum
Sent: Monday, January 8, 2018 8:02
To: Gregory P. Smith
Cc: Christian Tismer; Python-Dev
Subject: Re: [Python-Dev] subprocess not escaping "^" on Windows

On Sun, Jan 7, 2018 at 12:30 PM, Gregory P. Smith <greg at krypto.org> wrote:
the best way to improve shell escaping on windows is to send a PR against the list2cmdline code that escapes everything you believe it should when running on windows. With hyperlinks to the relevant msdn info about what might need escaping.


Agreed. FWIW the call to list2cmdline seems to compound the problem, since it just takes args and puts double quotes around it, mostly undoing the work of list2cmdline. For example if I use (args=['a', 'b c'], shell=True) I think list2cmdline turns that to args='a "b c"', and then the format() expression constructs the command:

    cmd.exe /c "a "b c""

I really have no idea what that means on Windows (and no quick access to a Windows box to try it) but on Windows that would create *two* arguments, the first one being 'a b' and the second one 'c'.

At this point I can understand that Christian recommends against shell=True -- it's totally messed up! But the fix should really be to fix this, not inventing a new feature.

-- 
--Guido van Rossum (python.org/~guido)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-dev/attachments/20180108/0da89205/attachment.html>