Python 3.4+Async programmingfunction

asyncio.create_subprocess_shell()

subprocesses

Runs a command through the shell (sh on Unix, cmd.exe on Windows) without blocking the event loop; the command is a single string.

Syntax

proc = await asyncio.create_subprocess_shell(cmd, stdin=None, stdout=None, stderr=None, **kwds)

The shell parses the whole string, so inserting user input without shlex.quote() is a direct path to command injection. The returned Process is the shell process: proc.pid and proc.kill() refer to sh, not to the program it launched, whose children may survive kill(). If you need no shell features (pipes, *, &&), use create_subprocess_exec.

Examples

import asyncio
import shlex
async def main():
    name = "мир; rm -rf /"  # чужой ввод
    proc = await asyncio.create_subprocess_shell(
        'echo ' + shlex.quote(name),
        stdout=asyncio.subprocess.PIPE,
    )
    out, _ = await proc.communicate()
    print(out.decode().strip())  # → мир; rm -rf /
asyncio.run(main())

See also

Open in the full glossarydocs.python.orgReport an inaccuracy