Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You can always set shell=True and pass in an entire command line as a string, but… don’t do that. It seems really nice until the first time you get the shell escaping wrong, and then it’s something you tend never to do again.

For example,

  subprocess.run(“rm -rf ~/ some file”, shell=True)
and

  subprocess.run([“rm”, “-rf”,  “~/ some file”])
have significant different behavior.


What is the difference in behavior? They both look like they would delete the user's home directory. I assume the latter would try to delete a directory literally named with a tilde instead?


The latter passes each item in the list into the child processes’s argv, as-is, without the shell parsing them. That means this would delete a single item named “~/ some file”, spaces and all, instead of three items named “~/“, “some”, and “file”.

Edit: I’m typing this on my phone, so brevity won over explicitness. The latter probably wouldn’t expand ~. Imagine a file named “/home/me/ some file” for a better example.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: