Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail
From: Tim Daneliuk <tundra@tundraware.com>
Newsgroups: comp.lang.python
Subject: Re: Quotation Ugliness
Date: Wed, 26 Nov 2014 08:58:59 -0600
Organization: A noiseless patient Spider
Lines: 53
Message-ID: <5475EAB3.7060503@tundraware.com>
References: <grifkb-kpo1.ln1@ozzie.tundraware.com> <mailman.16304.1416966896.18130.python-list@python.org> <54756D5F.4040806@tundraware.com> <mailman.16320.1417007333.18130.python-list@python.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: mx02.eternal-september.org; posting-host="d887b3e675279b69468e57e74ea1dcb8"; logging-data="31150"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18WKCTwp0YiTnQLKzG0yWYjdszgzhJg7QU="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0
In-Reply-To: <mailman.16320.1417007333.18130.python-list@python.org>
Cancel-Lock: sha1:xudAn8Ck8Fl8hlRGL0CnPWFiXPA=
Xref: csiph.com comp.lang.python:81573

On 11/26/2014 06:56 AM, Tim Chase wrote:
> On 2014-11-26 00:04, Tim Daneliuk wrote:
>> someprog.py uname && sudo cat /etc/sudoers
>>
>> vs.
>>
>> someprog.py uname && echo "sudo cat /etc/suoders"
>>
>>
>> In the first instance, I need the sudo passoword, in the second I
>> don't.
>
> This doesn't jibe with the pairs of quotes you sent and your request
> for nesting.  In most popular shells, the majority of your "quote"
> characters don't actually quote anything:
>
>    bash$ echo // hello
>    hello
>    bash$ echo /* hello */
>    [returns all the items in my root directory, the word "hello",
>    along with all the sub-directories in the current directory]
>    bash$ echo this#and#that
>    this#and#that
>    bash$ echo this # and #that
>    this
>
> and has problems with things like
>
>    someprog.py uname && su""do cat /etc/sudoers
>    someprog.py uname && s"ud"o cat /etc/sudoers
>
> which my shell will parse valid execution of sudo.

<SNIP>


I am not writing in bash,  but in python.

The specific program in question I am modifying is
one that takes a shell command and executes it remotely on many machines.
The problem I am trying to solve is to determine whether the user needs to
provide a sudo password or not.  Right now, the program just naively checks
the arguments to see if .startswith("sudo').  As the example given illustrates,
that clearly fails if the sudo is given later in a longer pipeline.

Scanning the whole argument string for 'sudo' is better but will yield
false positives if the string is inside a quote of some sort.  Since I have
to solve the problem for ' and " delimiters, I thought I'd generalize the solution
for other strings possibly being quoted by other delimiters.
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/