Appion

I disagree what if my cp command is in /usr/local/bin/ or something. Ideally, one should use shutil.copy(src, dest) in your example.

If the user wants cp -i, the should check if its a login shell or something.

I agree, ideally shutil.copy should be used and is what I original suggested. However, Jim and Anchi feel that this is not the ideal case and that we should still call subprocess. In that case, we should use a fully qualified command name. What if the program you have in /usr/local/bin/cp isn't even the copy command. Unless some has seriously altered their system in ways they shouldn't /bin/cp is as universal as you are going to get. Using it makes sure you getting the expected behavior.

While shutil.copy(src, dest) will solve the calls from python, I saw a few places that it is part of a series of commands written to a file and then executed. What would we do there then?

I will start to go through and fix any of these problems. I assume we are worried about any command execution, not just simple shell commands like "cp"? For example, there are calls to "tar", "svn", and others. Some of them are probably safe, but I guess we can't assume anything about how someone configured their system.

This is probably a problem throughout all of myami, not just appion.

The first step is to find all places where this could be a problem. Although suprocess.Popen is the currently accepted way of calling external programs, there are other older functions to look for, like os.popen, os.system, os.exec*. Here is a command to locate potential lines to fix, executed in the top level of myami:

grep -rI --exclude-dir=.svn "Popen" *

Then there are the places like Anchi mentions, where a script or job file is being built and then executed. This applies to php and python. It's hard to grep for those.