Skip to main content

Shell escape a string to safely use it as a token in a shell command (backport of Python shlex.quote for Python versions 2.x & < 3.3)

Project description

Source Repository: https://github.com/chrissimpkins/shellescape

Description

The shellescape Python module defines the shellescape.quote() function that returns a shell-escaped version of a Python string. This is a backport of the shlex.quote() function from Python 3.4.3 that makes it accessible to users of Python 3 versions < 3.3 and all Python 2.x versions.

quote(s)

From the Python documentation:

Return a shell-escaped version of the string s. The returned value is a string that can safely be used as one token in a shell command line, for cases where you cannot use a list.

This idiom would be unsafe:

>>> filename = 'somefile; rm -rf ~'
>>> command = 'ls -l {}'.format(filename)
>>> print(command)  # executed by a shell: boom!
ls -l somefile; rm -rf ~

quote() lets you plug the security hole:

>>> command = 'ls -l {}'.format(quote(filename))
>>> print(command)
ls -l 'somefile; rm -rf ~'
>>> remote_command = 'ssh home {}'.format(quote(command))
>>> print(remote_command)
ssh home 'ls -l '"'"'somefile; rm -rf ~'"'"''

The quoting is compatible with UNIX shells and with shlex.split():

>>> remote_command = split(remote_command)
>>> remote_command
['ssh', 'home', "ls -l 'somefile; rm -rf ~'"]
>>> command = split(remote_command[-1])
>>> command
['ls', '-l', 'somefile; rm -rf ~']

Usage

Include shellescape in your project setup.py file install_requires dependency definition list:

setup(
    ...
    install_requires=['shellescape'],
    ...
)

Then import the quote function into your module(s) and use it as needed:

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from shellescape import quote

filename = "somefile; rm -rf ~"
escaped_shell_command = 'ls -l {}'.format(quote(filename))

Issue Reporting

Issue reporting is available on the GitHub repository

Project details


Release history Release notifications

This version
History Node

3.4.1

History Node

3.4.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
shellescape-3.4.1-py2.py3-none-any.whl (4.9 kB) Copy SHA256 hash SHA256 Wheel 2.7 May 13, 2015
shellescape-3.4.1.tar.gz (4.9 kB) Copy SHA256 hash SHA256 Source None May 13, 2015

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging CloudAMQP CloudAMQP RabbitMQ AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page