[issue34540] shutil._call_external_zip should use subprocess

[Benjamin Peterson]

Benjamin Peterson  added the comment:


New changeset d8b103b8b3ef9644805341216963a64098642435 by Benjamin Peterson in 
branch '2.7':
closes bpo-34540: Convert shutil._call_external_zip to use subprocess rather 
than distutils.spawn. (GH-8985)
https://github.com/python/cpython/commit/d8b103b8b3ef9644805341216963a64098642435


--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34540] shutil._call_external_zip should use subprocess

[Benjamin Peterson]

Change by Benjamin Peterson :


--
keywords: +patch
pull_requests: +8458
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34540] shutil._call_external_zip should use subprocess

[Benjamin Peterson]

New submission from Benjamin Peterson :

disutils.spawn isn't very good at quoting command lines (#8987). We need to use 
subprocess to avoid shell injection.

--
components: Library (Lib)
messages: 324301
nosy: benjamin.peterson
priority: normal
severity: normal
status: open
title: shutil._call_external_zip should use subprocess
versions: Python 2.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com