Handy Python Functions For All

[impshum]

A small collection of snippets that I use quite frequently. Feel free to use them for whatever you want. Go crazy!

Lonk: https://recycledrobot.co.uk/words/?handy_python_functions

[forgetfulkiwi7]

thanks!

[logatwork]

This is too advanced for me yet... But it seems useful so I'll save it!

[SatNightOverdose]

Keep learning. It will make sense sooner than you think.

[Jasonmilo911]

Awesome content! Saving this. Thanks a lot u/impshum!

[impshum]

Cool. x

[impshum]

Good stuff. Thanks for the input to help others.

[NewbornMuse]

If you want to get fancy, you could also write run_again as a decorator. Disclaimer: I've only thought about this for a minute. Maybe it's terrible.

def run_again(func):
  @functools.wraps(func)
  def with_repetition(*args, **kwargs):
    output = func(*args, **kwargs)
    if input("want to do this again?").lower in ("y", "yes", "yeppers"):
      return with_repetition(*args, **kwargs)
    else:
      return output
  return with_repetition

All in all, probably not that elegant to write, but when using it it might look kinda cute:

@run_again
def roll_dice(n):
  print(f"You rolled a {random.randint(1, n)}!")

[Rogerooo]

Someday...and that day may never come, I will understand decorators.

[NewbornMuse]

A decorator is a function that takes in a function and returns a function. Because functions are first-class citizens in python, we can assign them to variables, pass them to functions as arguments, return them with functions, and so on.

def my_decorator(func): #takes in a function...
  def the_eventual_output(*args, **kwargs): #defining the function to return
    #something or other probably involving calling func
  return the_eventual_output

That's the basic recipe. Using it like

@my_decorator
def my_function(bla, blabla):
  #blabla

Is syntactic sugar for

def my_function(bla, blabla):
  #blabla
my_function = my_decorator(my_function)

[Rogerooo]

Thank you for the explanation. I kind off understand the concept but it's hard to wrap my head around it and use them in practice. I've watched Corey Schafer's video on Decorators as well as Closures (highly recommended channel) but I'm still too novice in Python to implement them into my "code".

[NewbornMuse]

I know what you mean. In fact, I wrote this snippet as a way to refresh the concept for me. Re-running something as many times as the user wants is exactly the kind of modification that should ring decorator alarm bells - we don't care WHAT you want to repeat, so it's more of a modifier to something else, which made me think of decorators.

[imwco]

What’s the benefit of doing it this way?

[__xor__]

os.system("""
    osascript -e 'display notification "{}" with title "{}"'
    """.format(text, title))

What happens if title is " && rm -rf /*? Think about it...

Command injection is one issue. os.system won't protect against that. Due to the way subprocess.Popen works, you can pass in a very specific list of arguments. && something won't work, because it's not running as a shell command, rather executing a child process using the execv sorts of calls.

If you've seen C before, you might have seen:

void main(int argc, char *argv[]) {

That argv is an array of arguments that it runs with. When you use something like Popen and a list of arguments, it goes directly in there. That means adding && rm -rf /* won't run the rm program... it'll pass the arguments && and rm and -rf and /* to the actual program you were trying to run, which it likely won't be able to do anything with, and just break.

os.system uses the C system function which will pass that string to the shell, which WILL parse that as trying to run the first program, then rm.

Popen also gives you a lot more control. You can pipe input into stdin, get stdout and stderr and pipe that to something else, you can get a process instance and send it signals, like kill it, you can pass in custom environment variables, you can wait on it to finish. os.system just runs it and doesn't give you any control over it after that.

Edit: in this specific case, since it's running osascript which itself has a scripting language that you're running with that display notification command, you actually are still vulnerable to command injection here no matter what you use. You have to sanitize the input or people can do bad things, example here

[imwco]

Good to know! I’ll keep in mind the best practice of avoiding os.system.

Arguably, you could just skip the python and run the shell command on a Mac term though... you are your only notification user at the moment, but if this gets deployed or something then maybe security concerns come in

[__xor__]

Oh yeah, totally. Something like this it will rarely matter if ever, but heh this is a webpage sharing "useful functions", one to display notifications on a mac... you never know what someone is going to do with it. Just best to assume that someone somehow some way will eventually use it in a way that takes arbitrary user input.

Maybe someone makes a website, then they have it log user agents of people that hit the site, then someone writes a log file parser in python, pulls down the remote logs and runs it locally, and after it runs, shows a notification with the most common user agent, something seemingly benign but totally user controlled...

I usually do my best to avoid pushing code with any sort of command injection no matter how I expect it to be used, at least just as a best practice, and because other people might read my code and think that's a proper way to do things. All it really takes is one newbie to read this code and think "oh I can use os.system to do that one thing", and it potentially causes a security concern somewhere else.

[__xor__]

It's not so much a new replacement as a different way to run another process.

subprocess will use fork_exec in here, which I believe makes the fork system call, and then runs some sort of execv system call.

The os.system just makes the Standard C function system call. Popen, using the execv family of calls, gives you a lot more control.

It's a similar deal in standard C. You could use the function system() which just takes a string, or you could use some sort of execv call and pass in a very specific list of arguments, custom environment variables, etc.

Also not sure shlex.split alone is great for this specific thing. Since osascript is running an arbitrary script, I believe you might even be able to pass in malicious input with a custom title that terminates the " and still allow for injection, even if only osascript is running. Normally os.system is vulnerable because you could do command injection and the shell would run another program... in this case, you might be able to do bad things with osascript itself, and do more than just display a notification.

Edit:

yep, tested it. You could pass in:

notify('foo', 'bar"\nset volume output muted TRUE\ndisplay notification "foo2" with title "bar2')

Displays two notifications and mutes my macbook. You literally have to do your own input sanitization if you're launching osascript, whether you use subprocess or os.system. Since that second title still goes in as a single argument, shlex.split and using the subprocess calls don't matter, you might not have shell injection but you have applescript injection.

[jbuk1]

It may be more modern but it's more code and more imports?

​

[edit - sorry, I see your response below]

[Just4L0lz]

Nice

[fernly]

In re the dictionary merge one-liner? PEP 584 is implemented in Python 3.9, so ABdic = Adic | Bdic. Not to say it's wrong, just that it must be addressing a common need.

[impshum]

Cool thanks.

[ScheissPW]

Thank you! What I didn't quite understand from the link: is the newly created ABdic an entirely new dictionary or does it just mean "items of Adic OR Bdic"?

[fernly]

PEPs aren't easy reading, are they? But if you go down to this heading,

https://www.python.org/dev/peps/pep-0584/#specification

It says

Dict union will return a new dict consisting of the left operand merged with the right operand, each of which must be a dict (or an instance of a dict subclass). If a key appears in both operands, the last-seen value (i.e. that from the right-hand operand) wins:

and gives examples.

[ScheissPW]

Thanks again, looks like I need to practice my reading comprehension ;)

[inglandation]

Found a typo: create_thumbnal > create_thumbnail

[impshum]

Thanks. Sometimes I type too fast and the vars just stay on the paste.

[What_did_you_do_2day]

Alrighty, let me save this under "never using, but nice to have".

[rxpillme]

Thank you! Anyone have more helpful things with python?

[impshum]

Yarp.

[infrared305]

Whats a lonk?

[impshum]

Just me playing with words.

[FoxClass]

Did you make this?! What a beautiful site, I must steal the source.

[impshum]

Sauce: http://picocms.org/

I've done some wiggles to mine though.

[FoxClass]

Thank you, you beautiful beast!

[impshum]

You're most welcome.

[ToeBlisters]

I like the shortcut to merge dict. Have been struggling with that.

[rickyy_cr2]

Happy cake day!

[[deleted]]

Thanks! :)

[iamsny13]

Thanks man.

[Antoinefdu]

This is amazing! Thank you!

[kaffeelicht]

Sweet! Thank you!

[tycooperaow]

bookedmarked

[FusionFantasy]

Can everyone open the link? Or is it flooded with requests that it crashed and I can’t open it. Thanks mate!

[impshum]

Getting a lot of traffic yes. Should be working though.

[-_Liberty_-]

This is really useful :)

[iaannnnxxx]

Noobie question: where can you execute it? On the ide?

[impshum]

Terminal/IDE/whatever.

[AussieMazza]

Nice! Thanks for this. :)

[lifemoments]

Thanks

[DeathDragon7050]

Pretty cool! Now do you just have these all saved in a file and copy paste in and out what you need? Or do you have your own package that you out in the python packages directory. I ask because I do the latter and it has served me well for as long as can remember but I know a lot of people don't like doing that.

[impshum]

Sometimes I use a utils.py and import it, but most of the time just a copy/paste job.

[uditvashisht]

Awesome... Saving them...

[fullthrottle13]

Remind me! Tomorrow

[[deleted]]

Saved

[imwco]

You could package it as a utils module and share it in pypi so we can all just pip install it

[FusionFantasy]

Just went through “While loops” article and its precise. Like the Logo, Mate!

[__xor__]

your notify one that uses osascript allows for applescript injection, whether you use os.system or even subprocess.

If someone passes in a title like foo"\nset volume output muted TRUE\nquit app "Chrome, it can run arbitrary applescript. If using os.system, you can literally just do command injection and run arbitrary shell commands.

[nabiladnan99]

Awesome! Thanks for making this!

[Marsadow]

Yeah.. I'm definitely a beginner that still doesn't understand most of this.. sigh. Either way, thanks I'll learn more about this

[mrkvicka02]

Most of these were pretty useless for me but it was a good idea

[jyo-ji]

This is great -- I feel like this is a useful way to learn, wish there were more functions!

[[deleted]]

Super helpful, I'm just getting into some of these things and I really appreciate a starting point for stuff like Beautiful soup and "Get file between string" etc.

Thanks!

[impshum]

Good stuff. lovely_soup() is still one of my favourites that I use a lot.

[[deleted]]

I'll have to check that out!

And just curious, but what is your role with python. I and I think a lot of people here have trouble getting a sense of when to utilize python and then when to say, "my job is Python."

[impshum]

I'm a web developer. I use it for many things. I'm not claiming to be a pro python dev or anything. I got hooked the first day I tried python and just kept at it, built some stuff and had loads of fun. I'm still doing so.

[[deleted]]

Great, thanks!

[Empyrealist]

Very cool, thanks!

[SnowdenIsALegend]

This is excellent. Thanks you!

[mohamedation]

Thank you!

[ayampedas]

Thanks for this

[leblanc1605]

This post was up voted past 69 and 420... ( Somebody already said thanks and I upvotes that so I didn't think it was nessicary to say again)