Duplicity

  1. Bug #1520691
  2. Comment #8

Comment 8 for bug 1520691

Revision history for this message
Bernd Dietzel (l-ubuntuone1104) wrote :

Not only filenames, ... anything in the path like the name of a usb-stick could get a shell command.

So please to not use "shell=True" , it makes the "subprocess.Popen" command as insecure as the "os.popen" commands are.