The Codiga static code analysis not only detects unsafe code but also suggests fixes to correct it. The Codiga IDE plugins and the integrations with GitHub, GitLab, or Bitbucket let you detect unsafe usage of the Python subprocess module. Automatically detect unsafe use of the subprocess module The best solution to use safely subprocess is to avoid using

Still, the solution with shlex is one remediation and may not work everywhere (and raising run ( f'mycommand ' ), shell = True, check = True ) Say you have the following code: COPY import subprocess And itĪlso means that if the command contains any user inputs, the user may inject commands to execute When shell=True is used, the command must be formatted as if it were used in a shell. When the argument shell is set to True in its functions (such as Popen or run), the new The subprocess module has multiple convenient features that introduce potential vulnerability. Shell scripts (and Python more a more expressive language). It's convenient for automating tasks and more often more powerful than

This module is often used for system administration/devops scripts, where a program needs to interact with To execute new processes, get their outputs and check that they execute without any issues. The module has different methods (e.g., Popen, run) I have a python script invoked with Python 2.7.15 spawning another python script using Python 3.8.5, so it matches your scenario.New OS processes (think of it like a fork on steroids). Print('Runner started! Runner output follows.')įor line in iter(p.stdout.readline, b''):Īnd the current time from runner.py will be displayed in the executor.py script:Ĭode: Select all Aaron% python executor.py P = Popen(, stdout=PIPE, bufsize=1) # Note the '-u' flag. My demo below works with the '-u' and it does nothing at all without the flag.Ĭode: Select all Aaron% cat runner.pyĬode: Select all Aaron% cat executor.py It appears that you need to tell the spawned python process to not buffer its output by passing the '-u' flag. Maybe this will point you in the right direction or at least make you aware of the subprocess module if you haven't heard of it. Here is a snippet taken from one of the examples where you can write to the stdin of the spawned process (you can do something similar for reading from stdout as well):Ĭode: Select all proc = subprocess.Popen(, stdin=subprocess.PIPE) It covers writing to and reading from stdin and stdout of a subprocess: This is the Python 2.7 documentation for the subprocess module: Īnd I think this site has a great writeup with some examples on using the module.

You can spawn a new process from Python 2.7 code (to run your Python 3 script) and set it up such that the stdin and stdout can be read and written to.

I don't have any of my own examples I can provide, but are you familiar with the subprocess module in Python? It sounds like that may be what you want.

Python background subprocess output