Passing arguments from shell to embedded Python scripts

Question

I wrote a shell function, intended to be compatible with both zsh and bash:

py () { python -c 'print($1)'; }

but when i use py hello, I get an error from the Python interpreter:

➜  ~  py hello
  File "<string>", line 1
    print($1)
          ^
SyntaxError: invalid syntax

What am I doing wrong? Thanks!

Charles Duffy · Accepted Answer · 2015-01-11 18:08:05Z

2

Don't use string substitution at all -- that way lies (a cousin of) Bobby Tables. Instead, pass arguments out-of-band:

py() { python -c 'import sys; print sys.argv[1]' "$@"; }
py hello

To demonstrate why the other approach is dangerous:

py() { python -c "print('${1}')"; }
py "hello' + str(__import__('os').system('touch /tmp/broke-your-security')) + '"

When run, this code creates a file /tmp/broke-your-security. Consider what would happen if that command instead involved rm -rf, or curl | sh to pull down a rootkit.

edited Jan 11, 2015 at 18:08

answered Jan 11, 2015 at 16:23

Charles Duffy

299k43 gold badges442 silver badges498 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Sindhu S Over a year ago

hi! i am not using this function in production, just for personal use :)

Charles Duffy Over a year ago

@sindhus, sure, but you'll eventually be writing production code, no? Better to be in good habits before it matters. :)

Collectives™ on Stack Overflow

Passing arguments from shell to embedded Python scripts

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related