Meta tags:

Headings (most frequently used words):

python, pipes, to, avoid, shells, incorrect, correct, consequences, references, openstack, community, documentation, branding, legal, stay, in, touch, contents,

Text of the page (most frequently used words):
the (23), shell (15), #openstack (13), subprocess (12), pipes (9), and (9), that (9), curl (9), website (9), you (8), guides (7), pipe (7), stdout (7), count_lines (7), python (6), avoid (6), file (6), output (6), false (6), openinfra (5), user (5), this (5), use (5), google (5), foundation (5), docs (4), documentation (4), community (4), shells (4), stdin (4), not (4), for (4), can (4), www (4), com (4), process_curl (4), args (4), legal (3), events (3), correct (3), html (3), popen (3), things (3), injection (3), more (3), what (3), communicate (3), which (3), should (3), process_wc (3), return (3), def (3), check_output (3), function (3), uses (3), true (3), clouds (3), project (2), under (2), org (2), computing (2), license (2), policy (2), wiki (2), api (2), jobs (2), news (2), blog (2), security (2), references (2), consequences (2), incorrect (2), document (2), page (2), last (2), deadlock (2), memory (2), want (2), into (2), reading (2), writing (2), process (2), directly (2), work (2), rather (2), than (2), our (2), run (2), them (2), from (2), args2 (2), have (2), how (2), doesn (2), does (2), before (2), calledprocesserror (2), command (2), line (2), could (2), resolve (2), host (2), because (2), allows (2), your (2), code (2), source (2), lines (2), here (2), private (2), summit (2), provided, powered, rackspace, cloud, apache, stay, touch, cla, privacy, trademark, logos, guidelines, branding, getting, started, manuals, contribute, companies, groups, projects, contents, 简体中文, simplified, chinese, türkçe, türkiye, português, portuguese, 한국어, korean, 日本語, japanese, italiano, italian, bahasa, indonesia, indonesian, français, french, deutsch, german, languages, contributor, operations, administration, configuration, install, found, error, report, bug, except, where, otherwise, noted, licensed, see, all, documents, creative, commons, attribution, updated, 2015, https, library, possible, with, using, helps, complex, situations, note, buffers, result, descriptor, treat, like, descriptors, actually, fds, they, may, block, nothing, connected, other, end, why, reads, until, eof, then, waits, terminate, generally, unless, really, know, doing, easy, yourself, situation, calling, single, runs, each, programs, separately, connect, specify, tells, send, respective, handler, close, allow, receive, sigpipe, exits, rely, mean, anything, special, when, tries, download, called, fix, issue, causes, broken, returned, non, zero, exit, status, raise, retcode, cmd, usr, lib, python2, 573, traceback, most, recent, call, convert, insecure, who, instructs, fetch, terrible, used, machine, way, simple, grab, program, tell, many, there, are, wordcount, lot, time, codebase, convenient, provides, ability, around, without, buffering, malicious, chain, additional, commands, after, legitimate, take, look, one, log, about, sponsor, sign, membership, join, drivers, consulting, integrators, remotely, managed, hosted, public, distros, appliances, training, marketplace, supporting, organizations, superuser, magazine, marketing, resources, get, certified, coa, speakers, bureau, technical, committee, welcome, start, videos, days, opendev, teams, gathering, survey, enterprise, containers, science, hpc, telecom, nfv, edge, ironic, bare, metal, users, production, cases, sample, configs, map, deployment, tools, sdks, components, overview, software, global, search, toggle, navigation, advisories, dev416,

Text of the page (random words):
python pipes to avoid shells openstack security advisories 0 0 1 dev416 documentation toggle navigation global search software overview openstack components sdks deployment tools openstack map sample configs use cases users in production ironic bare metal edge computing telecom nfv science and hpc containers enterprise user survey events openinfra summit project teams gathering opendev community events openstack openinfra days summit videos community welcome start here openstack technical committee speakers bureau openstack wiki get certified coa jobs marketing resources community news superuser magazine openinfra foundation supporting organizations openinfra foundation marketplace training distros appliances public clouds hosted private clouds remotely managed private clouds consulting integrators drivers blog docs join sign up for foundation membership sponsor the foundation more about the foundation log in python pipes to avoid shells python pipes to avoid shells you should take a look at the shell injection document before this one a lot of the time our codebase uses shell true because it s convenient the shell provides the ability to pipe things around without buffering them in memory and allows a malicious user to chain additional commands after a legitimate command is run incorrect here is a simple function that uses curl to grab a page from a website and pipe it directly to the wordcount program to tell us how many lines there are in the html source code def count_lines website return subprocess check_output curl s wc l website shell true count_lines www google com 7 n that output is correct by the way the google html source does have 7 lines the function is insecure because it uses shell true which allows shell injection a user to who instructs your code to fetch the website rm rf can do terrible things to what used to be your machine if we convert the function to use shell false it doesn t work def count_lines website args curl website wc l return subprocess check_output args shell false count_lines www google com curl 6 could not resolve host curl 6 could not resolve host wc traceback most recent call last file stdin line 3 in count_lines file usr lib python2 7 subprocess py line 573 in check_output raise calledprocesserror retcode cmd output output subprocess calledprocesserror command curl www google com wc l returned non zero exit status 6 the pipe doesn t mean anything special when shell false and so curl tries to download the website called this does not fix the issue rather it causes it to be more broken than before if we can t rely on pipes if we have shell false how should we do this correct def count_lines website args curl website args2 wc l process_curl subprocess popen args stdout subprocess pipe shell false process_wc subprocess popen args2 stdin process_curl stdout stdout subprocess pipe shell false allow process_curl to receive a sigpipe if process_wc exits process_curl stdout close return process_wc communicate 0 count_lines www google com 7 n rather than calling a single shell process that runs each of our programs we run them separately and connect stdout from curl to stdin for wc we specify stdout subprocess pipe which tells subprocess to send that output to the respective file handler treat pipes like file descriptors you can actually use fds if you want they may block on reading and writing if nothing is connected to the other end that s why we use communicate which reads until eof on the output and then waits for the process to terminate you should generally avoid reading and writing to pipes directly unless you really know what you re doing it s easy to work yourself into a situation that can deadlock note that communicate buffers the result in memory if that s not what you want use a file descriptor for stdout to pipe that output into a file consequences using pipes helps you avoid shell injection in more complex situations it s possible to deadlock things with pipes in python or in shell references https docs python org 2 library subprocess html subprocess popen stdin this page last updated 2015 05 07 12 16 44 except where otherwise noted this document is licensed under creative commons attribution 3 0 license see all openstack legal documents found an error report a bug openstack documentation guides install guides user guides configuration guides operations and administration guides api guides contributor guides languages deutsch german français french bahasa indonesia indonesian italiano italian 日本語 japanese 한국어 korean português portuguese türkçe türkiye 简体中文 simplified chinese contents python pipes to avoid shells incorrect correct consequences references openstack projects openstack security blog news community user groups events jobs companies contribute documentation openstack manuals getting started api documentation wiki branding legal legal docs logos guidelines trademark policy privacy policy openinfra cla stay in touch the openstack project is provided under the apache 2 0 license docs openstack org is powered by rackspace cloud computing