os.popen and the subprocess module

[Andrew]

Hello world,

I'm working on a script that will run an executable obtaine the output
from the executable
and do some analysis on the output. Essentially the script runs the
executable analyses
the data.
I'm looking into os.popen and the subprocess module, implementing os.popen
is easy but i hear
it is depreciating however I'm finding the implemantation of subprocess
daunting can anyone help

Dx

 

[Thomas Rachel]

Am 27.11.2012 19:00 schrieb Andrew:

I'm looking into os.popen and the subprocess module, implementing
os.popen is easy but i hear it is depreciating however I'm finding the
implemantation of subprocess daunting can anyone help

This is only the first impression.

subprocess is much more powerful, but you don't need to use the full power.

For just executing and reading the data, you do not need much.

First step: create your object and performing the call:

sp = subprocess.Popen(['program', 'arg1', 'arg2'], stdout=subprocess.PIPE)

or

sp = subprocess.Popen('program arg1 arg2', shell=True,
stdout=subprocess.PIPE)


The variant with shell=True is more os.popen()-like, but has security
flaws (e.g., what happens if there are spaces or, even worse, ";"s in
the command string?


Second step: Obtain output.

Here you either can do

stdout, stderr = sp.communicate()

can be used if the whole output fits into memory at once or you really
have to deal with stderr or stdin additionally.

In other, simpler cases, it is possible to read from sp.stdout like from
a file (with a for loop, with .read() or whatever you like).


Third step: Getting the status, terminating the process.

And if you have read the whole output, you do status = sp.wait() in
order not to have a zombie process in your process table and to obtain
the process status.


Thomas

 

[Nobody]

The variant with shell=True is more os.popen()-like, but has security
flaws (e.g., what happens if there are spaces or, even worse, ";"s in the
command string?

I think that you're conflating the shell= option with whether the command
is a given as a list or a string.

Attempting to construct a command string risks introducing security flaws
(or other bugs). Wherever possible, the first argument should be a list. A
string should only be used if that's what you're given (e.g. via a
configuration file), in which case it should be used literally, without
any attempt to substitute filenames or other parameters.

On Windows, list-versus-string and shell= are orthogonal. A list will
always be converted to a string, as that's what the underlying
CreateProcess() function requires. shell=True prepends "cmd /c " ("cmd" is
replaced by the value of %comspec% if that is defined); this allows
execution of batch files, scripts, etc based upon their associations.

On Unix, passing a list with shell=True is rarely useful. It just prepends
['/bin/sh', '-c'] to the list, so the first item is the shell command
while subsequent items provide the values for the shell variables $1, $2,
etc.

 

[emile]

On 11/29/2012 10:39 AM, Nobody wrote:

<aside>

Every time I see your posts "Shanghai Noodle Factory" sticks in my head
as my daily hummer.

</aside>