Comment 38 for bug 1520691

I think you are flogging a dead horse. As far as I can tell, it's not possible to detect intentional shell injection, and still allow all the chars in the filename that Linux does. You have some clever examples, but what's lacking is any suggestion on how to spot shell injections.

The lftp example is good, but that's in lftp itself. Since duplicity requires a path and a url, the commandline would be invalid.