Using data received from TCP socket [ python ]

Question

So, I am trying to pass parameters to a bash shell script across a python TCP socket connection. The script being executed in the bash shell always bombs out even though when I print the variable being passed to os.system() or subprocess.call() it looks correct. Any ideas? Small chunk of the code that is giving me issues.

while 1:
    conn, addr = s.accept()
    print 'Connected with ' + addr[0] + ':' + str(addr[1])    
    data = conn.recv(1024)
    if not data:
        break
    data2 = data.rstrip('\n')
    cmd = 'ls ' + data2
    #os.system(cmd)  
    subprocess.call([cmd], shell=True)
    print cmd

You need to be specific about how it "bombs out". What does happen, exactly? — Brian White
– Brian White, Commented Apr 6, 2015 at 13:42
Hi Brian, The program can locate the binary and runs it successfully in a bash shell however when attempting to add parameters in order to be passed to the bash binary, the binary does not interpret the parameters correctly causing it to return whatever error code that was programed for "invalid parameter" Using "ls" as an example: running "ls" works, passing "-l" to it fails when I print the variable cmd it returns what i would expect to work "ls -l" — user2740987
– user2740987, Commented Apr 6, 2015 at 16:35

Brian White · Accepted Answer · 2015-04-06 13:47:33Z

1

Python's subprocess call (doc) takes a single string to execute or a list of arguments. You're passing a string as a single argument and thus the entire thing is interpreted as the command to execute, which of course cannot be found.

subprocess.call(cmd, shell=True) or subprocess.call(['ls', data2])

The latter is preferred as it means a malicious caller cannot create arbitrary shell actions by passing "foo; rm -rf / &" down the socket.

Note: Better to use call(('ls', data2)) (parentheses instead of brackets) to create a simple Python "tuple" rather than a dynamic list for passing to call(...).

answered Apr 6, 2015 at 13:47

Brian White

8,8242 gold badges49 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

user2740987 Over a year ago

Hi Bran, Thank you for the thoughts! I will try this out and let you know my results.

user2740987 Over a year ago

Hi Brian, Trying your suggested method subprocess.call(('ls', data2)) leaves me still a bit broken. my output is: Connected with 127.0.0.1:36085 's: invalid option -- ' Try `ls --help' for more information. If I take the socket connection out of the equation and just try and pass the parameters to the script from statically assigned variables, it works great. I am thinking there is something to do with how the variable is created containing the information passed via the socket

Brian White Over a year ago

What's the value of data2? Does it start with a dash? Also, you wrote "s: invalid option --"... was that supposed to be "ls: invalid option"? Sockets are raw 8-bit connections so as long as you're passing the exact characters that make up the destination filename, you should be fine.

user2740987 Over a year ago

The value of data2 does start with a dash. I have tried sending "-l" for "ls -l" and "--blue" for "blink1-tool --blue". Oddly enough, the error message is exactly how I typed it. Missing its first character.

user2740987 Over a year ago

Perhaps the issue is with how the data is being transferred. I am using telnet as a client. As a test I setup a number of IF statements directly after I receive the data on the server. Basically if data == 1: print data else: print "fail" On the client I sent "1" however it always falls through the first test and prints fail

|

Collectives™ on Stack Overflow

Using data received from TCP socket [ python ]

1 Answer 1

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related