Message123232
-def getstatusoutput(cmd):
+def getstatusoutput(cmd, shell=True):
shell=True is dangerous, it can lead to shell command injection. I would prefer to set its default value to False. The function already exists in Python 3.1, but it is not used in Python source code. Is it too late to fix its API to avoid security vulnerabilities? |
|
Date |
User |
Action |
Args |
2010-12-03 12:35:36 | vstinner | set | recipients:
+ vstinner, eric.araujo, r.david.murray, brian.curtin, jldm |
2010-12-03 12:35:36 | vstinner | set | messageid: <1291379736.12.0.603595530618.issue10197@psf.upfronthosting.co.za> |
2010-12-03 12:35:34 | vstinner | link | issue10197 messages |
2010-12-03 12:35:34 | vstinner | create | |
|