Skip to main content

Shell escape a string to safely use it as a token in a shell command (backport of Python shlex.quote for Python versions 2.x & < 3.3)

Project description

Source Repository: https://github.com/chrissimpkins/shellescape

Description

The shellescape Python module defines the shellescape.quote() function that returns a shell-escaped version of a Python string. This is a backport of the shlex.quote() function from Python 3.4.3 that makes it accessible to users of Python 3 versions < 3.3 and all Python 2.x versions.

quote(s)

From the Python documentation:

Return a shell-escaped version of the string s. The returned value is a string that can safely be used as one token in a shell command line, for cases where you cannot use a list.

This idiom would be unsafe:

>>> filename = 'somefile; rm -rf ~'
>>> command = 'ls -l {}'.format(filename)
>>> print(command)  # executed by a shell: boom!
ls -l somefile; rm -rf ~

quote() lets you plug the security hole:

>>> command = 'ls -l {}'.format(quote(filename))
>>> print(command)
ls -l 'somefile; rm -rf ~'
>>> remote_command = 'ssh home {}'.format(quote(command))
>>> print(remote_command)
ssh home 'ls -l '"'"'somefile; rm -rf ~'"'"''

The quoting is compatible with UNIX shells and with shlex.split():

>>> remote_command = split(remote_command)
>>> remote_command
['ssh', 'home', "ls -l 'somefile; rm -rf ~'"]
>>> command = split(remote_command[-1])
>>> command
['ls', '-l', 'somefile; rm -rf ~']

Usage

Include shellescape in your project setup.py file install_requires dependency definition list:

setup(
    ...
    install_requires=['shellescape'],
    ...
)

Then import the quote function into your module(s) and use it as needed:

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from shellescape import quote

filename = "somefile; rm -rf ~"
escaped_shell_command = 'ls -l {}'.format(quote(filename))

Issue Reporting

Issue reporting is available on the GitHub repository

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for shellescape, version 3.4.1
Filename, size File type Python version Upload date Hashes
Filename, size shellescape-3.4.1-py2.py3-none-any.whl (4.9 kB) File type Wheel Python version 2.7 Upload date Hashes View hashes
Filename, size shellescape-3.4.1.tar.gz (4.9 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page