After being somewhat dumbfounded by the fact that there
is no easy way to securely give user input as
parameters to an external utility (because of the fact
that os.popen*() runs things in the shell), I was happy
to find that (os | popen2).popen[234]() will accept
either a string as the command and execute it within a
shell, or a string list which is executed directly.

This does not apply to os.popen(), however
popen2.popen[234]() all use this piece of code to
execute the command in the child process:

/usr/lib/python2.2/popen2.py
    def _run_child(self, cmd):
        if isinstance(cmd, types.StringTypes):
            cmd = ['/bin/sh', '-c', cmd]
        for i in range(3, MAXFD):
            try:
                os.close(i)
            except:
                pass
        try:
            os.execvp(cmd[0], cmd)
        finally:
            os._exit(1)

Meaning that unless cmd is a string it will be run
directly, outside of any shell.

This appears to be the case for os.popen[234]() as well
as popen2.popen*()

Logged In: YES 
user_id=569758

(The punch line which I omitted was that this fact is not
documented anywhere.)

Logged In: YES 
user_id=2369

Given that the command as list of strings feature only works
on Unix-like systems, ISTM it should perhaps only be
documented for the PopenN classes. Maybe the documentation
for the functions should state that on unix they accept
lists of strings, though.

Logged In: YES 
user_id=99508

Can I second that the documentation should definitely be
updated to reflect this possibility, even if it's only
available on *nix-like systems?  This is something that many
other languages in the same realm as Python (Perl, PHP,
etc.) support and document, and I can't see any good reason
why we *shouldn't* document a more secure way to give data
to external programs.

Logged In: YES 
user_id=752496

Please, could you verify if this problem persists in Python 2.3.4
or 2.4?

If yes, in which version? Can you provide a test case?

If the problem is solved, from which version?

Note that if you fail to answer in one month, I'll close this bug
as "Won't fix".

Thank you! 

.    Facundo

Logged In: YES 
user_id=752496

Should this be fixed in 2.4? Now we have the "subprocess"
module.

Logged In: YES 
user_id=99508

Yes, I believe it should.

Logged In: YES 
user_id=752496

Jeremy, could you please provide a patch for the docs? Thanks!

Logged In: YES 
user_id=99508

I think I misunderstood your question.  Yes, this *is* already fixed in the 
documentation for the subprocess module in 2.4.

Logged In: YES 
user_id=752496

Ok, fixed.