multiple argument from terminal using python

Question

I am able to run this properly using os.system. It is writing pcap file into text.

os.system("tshark -z 'proto,colinfo,tcp.srcport,tcp.srcport' -r filename.pcap > testfile")

But when I tried to give input file from termimal, I got following error: tshark: -z invalid argument

host = raw_input("Enter file name: ")   
test = subprocess.Popen(["tshark","-z","'proto,colinfo,tcp.srcport,tcp.srcport'","-r",host,">","testfile"], stdout=subprocess.PIPE)
output = test.communicate()[0]

Can anybody please figure out where I am making mistake?

Can you please post the full traceback you're receiving?

wnnmaw
– wnnmaw

2014-02-18 17:12:37 +00:00
Commented Feb 18, 2014 at 17:12 — wnnmaw
– wnnmaw, Commented Feb 18, 2014 at 17:12

isedev · Accepted Answer · 2014-02-18 17:24:22Z

2

To emulate the os.system command, use the shell=True parameter to subprocess.Popen and provide the same command string (not an array of strings):

subprocess.Popen("tshark -z 'proto,colinfo,tcp.srcport,tcp.srcport' -r " 
                 + host + "> testfile", stdout=subprocess.PIPE, shell=True)

You need a shell to interpret your command line as you are using output redirection to a file ("> testfile").

In your example, you are passing each element of the string list to the execve() system call and hence as parameters to the tshark command (which gets 'proto,colinfo,tcp.srcport,tcp.srcport' as the argument to the -z option instead of proto,colinfo,tcp.srcport,tcp.srcport and which won't know what to do with the > and testfile arguments).

As wnnmaw points out in his comment, using os.system or subprocess.Popen with shell=True with command lines built from user input (the host variable in your case) allows a user to pass arbitrary data to the shell. This can be used to execute (potentially nasty) commands on your system.

For instance, setting host in your example to ; /bin/rm -rf / would delete every file on a UNIX system (assuming the user running the process had enough privilege).

It is therefore very important to validate an user input before adding it to the command string.

edited Feb 18, 2014 at 17:24

answered Feb 18, 2014 at 17:14

isedev

19.7k3 gold badges65 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

wnnmaw Over a year ago

You should probably make note of the security risk associated with shell=True and un-sanitized input

user3304696 Over a year ago

Thanks for valuabe comment---

Collectives™ on Stack Overflow

multiple argument from terminal using python

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related