homepage

I heard that there was an undocumented feature to the
os.popen family, where instead of passing a command
string as the first argument you could pass a list, as
[path, arg1, arg2, ...], and circumvent any shell
interpretation. I was disapointed to see that this was
not so ("popen() argument 1 must be string, not list"
ditto tuple)
I believe this would be an excellent feature -- using
the shell is a significant source of errors due to
quoting, as well as a serious security concern. 95% of
the time the shell is not required. The shell also
introduces portability concerns (e.g., bug #512433) --
creating a Python shell is not necessary when the shell
is usually superfluous anyway.

Logged In: YES 
user_id=21627
This feature is indeed available in popen2.

Logged In: YES 
user_id=210337
I see you are correct. It would be nice if this feature was
consistent across all popen*, and was also documented (and
so also committed to with clear semantics)

Logged In: YES 
user_id=77756
Does this mean that giving a list to popen2 free us from
taking care of the dangerous characters that could be
interprated/escaped by the shell ???
I don't find any documentation about this feature !!!

Logged In: YES 
user_id=344921
popen5 never uses the shell
(http://www.lysator.liu.se/~astrand/popen5/)

Logged In: YES 
user_id=210337
This may not matter enough to resolve now, with the advent
of the subprocess module.

I agree this isn't required in popen since you can do it with the subprocess module. Closing.