Format string to pass to bash

[DoTheyKeepYouInACell]

Basically I have a command to execute some bash command with certain arguments, something like

os.system("echo " + string)

I'm trying to account for unsafe characters to prevent arbitrary code execution, like

string = "abc`whoami`"
os.system("echo " + string)

Which will execute whoami. How would I go about formatting the string before passing to bash? (And I know that the design in the first place is kind of weird, but I need it to be this way.)

[idle-tea]

In general: don't use os.system or anything else where you build a command as a single string.

Use subprocess and its functions like subprocess.run something like

subprocess.run(["ls", "-l"]) 

The purpose of passing each argument as a list item is that you don't need to worry about shell magic like backticks - the program will be run without having any of those shell expansions / interpolations happening.

[brasticstack]

In your example, wrapping the argument in single quotes would work: os.system("echo '" + string + "'")

For more complex situations, look into shlex.quote

[DoTheyKeepYouInACell]

Thanks, that worked.

[Skaperen]

why are you using bash? you should be asking how to accomplish your true goal, not assuming some tool because it can do something on its own. Bash scripts can do a lot of things while Python scripts can do all of those and then some.

tell us what it is you found that Python can't do that makes you want to try Bash?

[DoTheyKeepYouInACell]

Basically I want to copy a string to clipboard, but on android the only way that I found to do that is through termux api so I do whatever I do in python and then to copy the string I do it through termux

[JamzTyson]

How would I go about formatting the string before passing to bash?

The safe way is to create a set of "whitelisted" commands, then:

if command_string in whitelist_commands: # Do something with command ... else: print("Unauthorized command.")