kennethreitz/envoy — Issue #16: Don't encourage quoting mistakes and security holes
Author: fdr
Created: 2012-01-06 01:34:20+00:00
State: open

I think `envoy.run` is something of a massive foot-gun right now if the canonical way to manage arguments is with `%s` or new-style format strings. Although you have set `shell=False` and eschewed the system-dependent shell language for the cross-platform `shlex`, the following is just as vulnerable as `bash` or the `system` function in C (implemented in Perl and Ruby via backtick characters) to quoting problems and injection attacks:

```python
envoy.run('ls %s' % directory)
```

Where directory could have spaces, then passed to shlex and then take the form of additional arguments.

If you feel you must use an embedded languages for `.run` (which is a lot more terse than using vanilla lists or tuples in Python, such as `['ls', directory]`) please consider doing something akin to what database drivers do, which is supporting parameters that are interpreted by that driver rather than using the string substitution mechanisms.