3 ms·

subprocess.call is also vulnerable to this, though. It calls out to bash.

• Redoubts 12y ago
  I believe you would need to explicitly pass shell=True for that though.
  • meowface 12y ago
    Nope, it's not necessary. Test it with a vulnerable CGI app and call: subprocess.call(["date"]) Or if bash is not your default shell: subprocess.call(["bash", "-c", "date"])
• panzi 12y ago
  Vulnerable to what? The the environment variable problem? I was talking about program argument parsing. os.system("ls %s" % foo) != subrocess.call(["ls",foo])
  • meowface 12y ago
    Ah, I misunderstood then. I agree with you on that point. I assumed you were talking about "Shellshock".