logoalt Hacker News

kstrauseryesterday at 7:39 PM1 replyview on HN

You can always set shell=True and pass in an entire command line as a string, but… don’t do that. It seems really nice until the first time you get the shell escaping wrong, and then it’s something you tend never to do again.

For example,

  subprocess.run(“rm -rf ~/ some file”, shell=True)
and

  subprocess.run([“rm”, “-rf”,  “~/ some file”])
have significant different behavior.

Replies

lgastoday at 1:00 AM

What is the difference in behavior? They both look like they would delete the user's home directory. I assume the latter would try to delete a directory literally named with a tilde instead?

show 1 reply