Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deprecate shlex.split(None) to read from stdin. #77443

Closed
tiran opened this issue Apr 11, 2018 · 6 comments
Closed

Deprecate shlex.split(None) to read from stdin. #77443

tiran opened this issue Apr 11, 2018 · 6 comments
Labels
3.8 only security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error

Comments

@tiran
Copy link
Member

tiran commented Apr 11, 2018

BPO 33262
Nosy @ericvsmith, @tiran, @pganssle, @ZackerySpytz, @NiklasRosenstein, @akulakov
PRs
  • bpo-33262: Deprecate passing None for s to shlex.split() #6514
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = None
created_at = <Date 2018-04-11.10:28:49.441>
labels = ['3.8', 'type-bug', 'library']
title = 'Deprecate shlex.split(None) to read from stdin.'
updated_at = <Date 2021-08-29.19:19:42.031>
user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2021-08-29.19:19:42.031>
actor = 'andrei.avk'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2018-04-11.10:28:49.441>
creator = 'christian.heimes'
dependencies = []
files = []
hgrepos = []
issue_num = 33262
keywords = ['patch']
message_count = 5.0
messages = ['315189', '315209', '323489', '365468', '400555']
nosy_count = 6.0
nosy_names = ['eric.smith', 'christian.heimes', 'p-ganssle', 'ZackerySpytz', 'n_rosenstein', 'andrei.avk']
pr_nums = ['6514']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue33262'
versions = ['Python 3.8']
    @tiran
    Copy link
    Member Author

    tiran commented Apr 11, 2018

    The shlex module implements simple tokenize for a shell-like mini language. The shlex.split() function splits a string into subcomponents just like a typical Unix shell. However function has a surprising feature. When None is passed into shlex.split().

    Note: Since the split() function instantiates a shlex instance, passing None for s will read the string to split from standard input.

    https://docs.python.org/3/library/shlex.html#shlex.split

    This is both surprising, unnecessary and potentially dangerous. Reading from sys.stdin is a blocking operation. In case an application doesn't account for None, shlex.split(value) could lead to a blocked server application. I suggest to deprecate and eventually remove this mis-feature.

    Credits: David R. MacIver reported the bug on Twitter: https://twitter.com/DRMacIver/status/984001867985367040

    @tiran tiran added 3.8 only security fixes type-bug An unexpected behavior, bug, or error labels Apr 11, 2018
    @ericvsmith
    Copy link
    Member

    I agree that it should be deprecated. That's crazy behavior.

    I'd also recommend that shlex.shlex with instream=None be deprecated, but maybe that's too radical. It seems way too easy to accidentally pass in None.

    @ZackerySpytz ZackerySpytz mannequin added the stdlib Python modules in the Lib dir label Apr 17, 2018
    @NiklasRosenstein
    Copy link
    Mannequin

    NiklasRosenstein mannequin commented Aug 13, 2018

    I've just run into this as well -- I thought it was a bug until I found this issue. I also think that this is anything from sane.

    @pganssle
    Copy link
    Member

    pganssle commented Apr 1, 2020

    New changeset 975ac32 by Zackery Spytz in branch 'master':
    bpo-33262: Deprecate passing None for s to shlex.split() (GH-6514)
    975ac32

    @akulakov
    Copy link
    Contributor

    Can be closed as fixed (or perhaps renamed and kept open to track eventual raising of error in the future?)

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    @vstinner
    Copy link
    Member

    Follow-up issue #94352: shlex.split(): remove support for s=None.

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.8 only security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    5 participants
    @vstinner @akulakov @tiran @ericvsmith @pganssle