Repository: pallets/werkzeug

Issue:
debug mode crashes App Engine from "import Popen"
I have a Flask (0.10.1) application running on App Engine which crashes when using a recent version of Werkzeug (>=0.11.6). The following stacktrace shows that [`Popen` is being imported in `get_machine_id`](https://github.com/pallets/werkzeug/blob/master/werkzeug/debug/__init__.py#L68) as of a7066a7. 

Downgrading to Werkzeug 0.11.5 appears to be a suitable workaround.

```
ERROR    2016-05-06 19:10:31,021 wsgi.py:279] 
Traceback (most recent call last):
  File "/google-cloud-sdk/platform/google_appengine/google/appengine/runtime/wsgi.py", line 268, in Handle
    for chunk in result:
  File "/.../lib/werkzeug/debug/__init__.py", line 313, in debug_application
    is_trusted = bool(self.check_pin_trust(environ))
  File "/.../werkzeug/debug/__init__.py", line 363, in check_pin_trust
    if self.pin is None:
  File "/.../lib/werkzeug/debug/__init__.py", line 261, in _get_pin
    self._pin, self._pin_cookie = get_pin_and_cookie_name(self.app)
  File "/.../lib/werkzeug/debug/__init__.py", line 161, in get_pin_and_cookie_name
    get_machine_id(),
  File "/.../lib/werkzeug/debug/__init__.py", line 96, in get_machine_id
    _machine_id = rv = _generate()
  File "/.../lib/werkzeug/debug/__init__.py", line 68, in _generate
    from subprocess import Popen, PIPE
ImportError: cannot import name Popen
```



Discussion:
Why are you running the debugger on App Engine?

@untitaker I came across this issue when running the local development server with Flask in debug mode.  I'm not running the Werkzeug debugger explicitly.

I haven't used GAE, but it seems to me like you're running your Flask application in debug mode on a public server. This is a major security risk.

The bugfix for making the debugger work in GAE is trivial, but if this bug prevents people from owning themselves, all the better.

@untitaker I understand those risks and I'm definitely not running debug mode on the server. The mode is conditionally set using environment variables. Just in case you happen to be basing that off of the paths you're seeing in the stacktrace above, I modified them to remove irrelevant details about my laptop's home directory.

I don't understand. Are you able to emulate GAE locally?

[Yes](https://cloud.google.com/appengine/docs/python/tools/using-local-server).


Resolving patch:
diff --git a/werkzeug/debug/__init__.py b/werkzeug/debug/__init__.py
--- a/werkzeug/debug/__init__.py
+++ b/werkzeug/debug/__init__.py
@@ -65,14 +65,17 @@ def _generate():
 
         # On OS X we can use the computer's serial number assuming that
         # ioreg exists and can spit out that information.
-        from subprocess import Popen, PIPE
         try:
+            # Also catch import errors: subprocess may not be available, e.g.
+            # Google App Engine
+            # See https://github.com/pallets/werkzeug/issues/925
+            from subprocess import Popen, PIPE
             dump = Popen(['ioreg', '-c', 'IOPlatformExpertDevice', '-d', '2'],
                          stdout=PIPE).communicate()[0]
             match = re.search(b'"serial-number" = <([^>]+)', dump)
             if match is not None:
                 return match.group(1)
-        except OSError:
+        except (OSError, ImportError):
             pass
 
         # On Windows we can use winreg to get the machine guid


Test patch: