Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.000 X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'python.': 0.02; 'argument': 0.05; 'root': 0.05; 'modifying': 0.07; 'string': 0.09; 'arguments': 0.09; 'executes': 0.09; 'machines.': 0.09; 'pgp': 0.09; 'skip:/ 10': 0.09; '"quote"': 0.16; 'bash,': 0.16; 'pairs': 0.16; 'quoted': 0.16; 'sudo': 0.16; 'to:addr:python.list': 0.16; 'to:addr:tim.thechases.com': 0.16; 'to:name:tim chase': 0.16; 'wrote:': 0.18; 'trying': 0.19; 'later': 0.20; 'command': 0.22; 'example': 0.22; 'shell': 0.22; 'header:User-Agent:1': 0.23; 'instance,': 0.24; 'parse': 0.24; 'question': 0.24; 'possibly': 0.26; 'second': 0.26; 'header:In-Reply-To:1': 0.27; 'to:2**1': 0.27; 'am,': 0.29; 'tim': 0.29; "doesn't": 0.30; 'characters': 0.30; 'along': 0.30; 'chase': 0.31; 'directory,': 0.31; 'quotes': 0.31; 'remotely': 0.31; 'not.': 0.33; "i'd": 0.34; 'problem': 0.35; 'but': 0.35; 'false': 0.36; 'yield': 0.36; 'being': 0.38; 'problems': 0.38; 'checks': 0.38; 'skip:. 20': 0.38; 'to:addr :python-list': 0.38; 'quote': 0.39; 'to:addr:python.org': 0.39; 'solve': 0.60; 'most': 0.60; 'first': 0.61; 'provide': 0.64; 'charset:windows-1252': 0.65; 'determine': 0.67 Date: Wed, 26 Nov 2014 08:58:59 -0600 From: Tim Daneliuk User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 Newsgroups: comp.lang.python To: Tim Chase , python-list@python.org Subject: Re: Quotation Ugliness References: <54756D5F.4040806@tundraware.com> In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (ozzie.tundraware.com [75.145.138.73]); Wed, 26 Nov 2014 08:58:59 -0600 (CST) X-TundraWare-MailScanner-Information: Please contact the ISP for more information X-TundraWare-MailScanner-ID: sAQEwxW2037200 X-TundraWare-MailScanner: Found to be clean X-TundraWare-MailScanner-From: tundra@tundraware.com X-Spam-Status: No X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Message-ID: Lines: 53 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1417013956 news.xs4all.nl 2957 [2001:888:2000:d::a6]:53232 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:81571 On 11/26/2014 06:56 AM, Tim Chase wrote: > On 2014-11-26 00:04, Tim Daneliuk wrote: >> someprog.py uname && sudo cat /etc/sudoers >> >> vs. >> >> someprog.py uname && echo "sudo cat /etc/suoders" >> >> >> In the first instance, I need the sudo passoword, in the second I >> don't. > > This doesn't jibe with the pairs of quotes you sent and your request > for nesting. In most popular shells, the majority of your "quote" > characters don't actually quote anything: > > bash$ echo // hello > hello > bash$ echo /* hello */ > [returns all the items in my root directory, the word "hello", > along with all the sub-directories in the current directory] > bash$ echo this#and#that > this#and#that > bash$ echo this # and #that > this > > and has problems with things like > > someprog.py uname && su""do cat /etc/sudoers > someprog.py uname && s"ud"o cat /etc/sudoers > > which my shell will parse valid execution of sudo. I am not writing in bash, but in python. The specific program in question I am modifying is one that takes a shell command and executes it remotely on many machines. The problem I am trying to solve is to determine whether the user needs to provide a sudo password or not. Right now, the program just naively checks the arguments to see if .startswith("sudo'). As the example given illustrates, that clearly fails if the sudo is given later in a longer pipeline. Scanning the whole argument string for 'sudo' is better but will yield false positives if the string is inside a quote of some sort. Since I have to solve the problem for ' and " delimiters, I thought I'd generalize the solution for other strings possibly being quoted by other delimiters. ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/