Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #81529 > unrolled thread

Quotation Ugliness

Back to article view | Back to comp.lang.python

Contents

  Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-25 18:18 -0600
    Re: Quotation Ugliness Tim Chase <python.list@tim.thechases.com> - 2014-11-25 18:40 -0600
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-25 19:18 -0600
        Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-26 12:32 +1100
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:00 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:00 -0600
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-25 19:18 -0600
    Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-26 11:44 +1100
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-25 19:20 -0600
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-25 19:20 -0600
        Re: Quotation Ugliness Tim Chase <python.list@tim.thechases.com> - 2014-11-25 19:44 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:01 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:01 -0600
    Re: Quotation Ugliness Ben Finney <ben+python@benfinney.id.au> - 2014-11-26 12:54 +1100
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:04 -0600
      Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 00:04 -0600
        Using a password with ‘sudo’ (was: Quotation Ugliness) Ben Finney <ben+python@benfinney.id.au> - 2014-11-26 18:02 +1100
        Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-26 18:10 +1100
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 08:59 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 08:59 -0600
        Re: Quotation Ugliness Tim Chase <python.list@tim.thechases.com> - 2014-11-26 06:56 -0600
          Re: Quotation Ugliness Jussi Piitulainen <jpiitula@ling.helsinki.fi> - 2014-11-26 15:45 +0200
            Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 01:37 +1100
            Re: Quotation Ugliness Tim Chase <python.list@tim.thechases.com> - 2014-11-26 08:26 -0600
            Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 02:07 +1100
            Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 02:09 +1100
              Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:36 -0600
              Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:36 -0600
                Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 02:48 +1100
                  Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:55 -0600
                  Re: Quotation Ugliness random832@fastmail.us - 2014-11-26 11:00 -0500
                    Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 10:02 -0600
                    Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 10:02 -0600
                      Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 03:13 +1100
                      Re: Quotation Ugliness random832@fastmail.us - 2014-11-26 11:16 -0500
                        Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 10:54 -0600
                        Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 10:54 -0600
                      Re: Quotation Ugliness alister <alister.nospam.ware@ntlworld.com> - 2014-11-26 16:45 +0000
                        Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 10:54 -0600
                  Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:55 -0600
                Re: Quotation Ugliness random832@fastmail.us - 2014-11-26 10:53 -0500
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 08:58 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 08:58 -0600
            Re: Quotation Ugliness Chris Angelico <rosuav@gmail.com> - 2014-11-27 02:06 +1100
            Re: Quotation Ugliness Tim Chase <python.list@tim.thechases.com> - 2014-11-26 09:23 -0600
            Re: Quotation Ugliness Ben Finney <ben+python@benfinney.id.au> - 2014-11-27 07:24 +1100
        Re: Quotation Ugliness random832@fastmail.us - 2014-11-26 09:12 -0500
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:02 -0600
          Re: Quotation Ugliness Tim Daneliuk <tundra@tundraware.com> - 2014-11-26 09:02 -0600
            Re: Quotation Ugliness random832@fastmail.us - 2014-11-26 10:16 -0500

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#81563

On 2014-11-26 00:04, Tim Daneliuk wrote:
> someprog.py uname && sudo cat /etc/sudoers
> 
> vs.
> 
> someprog.py uname && echo "sudo cat /etc/suoders"
> 
> 
> In the first instance, I need the sudo passoword, in the second I
> don't.

This doesn't jibe with the pairs of quotes you sent and your request
for nesting.  In most popular shells, the majority of your "quote"
characters don't actually quote anything:

  bash$ echo // hello
  hello
  bash$ echo /* hello */
  [returns all the items in my root directory, the word "hello",
  along with all the sub-directories in the current directory]
  bash$ echo this#and#that
  this#and#that
  bash$ echo this # and #that
  this

and has problems with things like

  someprog.py uname && su""do cat /etc/sudoers
  someprog.py uname && s"ud"o cat /etc/sudoers

which my shell will parse valid execution of sudo.  

You state the problem as "I *just* want to find whether something is
quoted or not", but you have to clearly define what quoted means.
The standard library does provide the shlex module which comes fairly
close to what it sounds like you describe:

  def is_sudo(corpus):
    return "sudo" in shlex.split(corpus, comments="#")

but that still hiccups on

  >>> is_sudo("echo I love sudo")
  True

-tkc

[toc] | [prev] | [next] | [standalone]

#81565

Tim Chase writes:

> This doesn't jibe with the pairs of quotes you sent and your request
> for nesting.  In most popular shells, the majority of your "quote"
> characters don't actually quote anything:
> 
>   bash$ echo // hello
>   hello

Where did the // go?

[...]
> and has problems with things like
> 
>   someprog.py uname && su""do cat /etc/sudoers
>   someprog.py uname && s"ud"o cat /etc/sudoers
> 
> which my shell will parse valid execution of sudo.  

This one looks like "scare quotes":

$ "sudo" cat /etc/sudoers

(Sorry for the noise. I just find this amusing.)

[toc] | [prev] | [next] | [standalone]

#81569

On Thu, Nov 27, 2014 at 12:45 AM, Jussi Piitulainen
<jpiitula@ling.helsinki.fi> wrote:
> Tim Chase writes:
>
>> This doesn't jibe with the pairs of quotes you sent and your request
>> for nesting.  In most popular shells, the majority of your "quote"
>> characters don't actually quote anything:
>>
>>   bash$ echo // hello
>>   hello
>
> Where did the // go?

I've no idea.

rosuav@sikorsky:~$ echo // hello
// hello

Works for me.

ChrisA

[toc] | [prev] | [next] | [standalone]

#81576

On 2014-11-26 15:45, Jussi Piitulainen wrote:
> Tim Chase writes:
> >   bash$ echo // hello
> >   hello
> 
> Where did the // go?

The bad-copy-and-paste gremlins ate them :-o

Good catch. :)

-tkc

[toc] | [prev] | [next] | [standalone]

#81578

On Thu, Nov 27, 2014 at 1:26 AM, Tim Chase
<python.list@tim.thechases.com> wrote:
> On 2014-11-26 15:45, Jussi Piitulainen wrote:
>> Tim Chase writes:
>> >   bash$ echo // hello
>> >   hello
>>
>> Where did the // go?
>
> The bad-copy-and-paste gremlins ate them :-o
>
> Good catch. :)
>

I was searching the ol' memory banks, trying to figure out if there
was some way to tell the internal 'echo' command to use slash instead
of dash (maybe for DOS/Windows people??), in which case that would be
parsed as "echo -- hello" and would indeed simply echo "hello".

ChrisA

[toc] | [prev] | [next] | [standalone]

#81579

On Thu, Nov 27, 2014 at 2:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
> I was searching the ol' memory banks, trying to figure out if there
> was some way to tell the internal 'echo' command to use slash instead
> of dash (maybe for DOS/Windows people??), in which case that would be
> parsed as "echo -- hello" and would indeed simply echo "hello".

Speaking of which, it's entirely possible to have a "-sudo" parameter
to a command (which would be "-s -u -d -o" to many programs), so
that's another way to get a false positive.

ChrisA

[toc] | [prev] | [next] | [standalone]

#81586

On 11/26/2014 09:09 AM, Chris Angelico wrote:
> On Thu, Nov 27, 2014 at 2:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
>> I was searching the ol' memory banks, trying to figure out if there
>> was some way to tell the internal 'echo' command to use slash instead
>> of dash (maybe for DOS/Windows people??), in which case that would be
>> parsed as "echo -- hello" and would indeed simply echo "hello".
>
> Speaking of which, it's entirely possible to have a "-sudo" parameter
> to a command (which would be "-s -u -d -o" to many programs), so
> that's another way to get a false positive.
>
> ChrisA
>

Yeah, there is no foolproof way to do this short of implementing a parser
that acts exactly as the shell itself would when parsing the command line.

The more I think about this, the more I think I am just going to look for the
string 'sudo' anywhere in the argument.  This merely will force the user to
enter their sudo password if detected.  If it turns out to be a false positive,
no harm will be done and the password will just go unused.


Thanks for the feedback.
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81587

On 11/26/2014 09:09 AM, Chris Angelico wrote:
> On Thu, Nov 27, 2014 at 2:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
>> I was searching the ol' memory banks, trying to figure out if there
>> was some way to tell the internal 'echo' command to use slash instead
>> of dash (maybe for DOS/Windows people??), in which case that would be
>> parsed as "echo -- hello" and would indeed simply echo "hello".
>
> Speaking of which, it's entirely possible to have a "-sudo" parameter
> to a command (which would be "-s -u -d -o" to many programs), so
> that's another way to get a false positive.
>
> ChrisA
>

Yeah, there is no foolproof way to do this short of implementing a parser
that acts exactly as the shell itself would when parsing the command line.

The more I think about this, the more I think I am just going to look for the
string 'sudo' anywhere in the argument.  This merely will force the user to
enter their sudo password if detected.  If it turns out to be a false positive,
no harm will be done and the password will just go unused.


Thanks for the feedback.
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81589

On Thu, Nov 27, 2014 at 2:36 AM, Tim Daneliuk <tundra@tundraware.com> wrote:
> The more I think about this, the more I think I am just going to look for
> the
> string 'sudo' anywhere in the argument.  This merely will force the user to
> enter their sudo password if detected.  If it turns out to be a false
> positive,
> no harm will be done and the password will just go unused.

That sounds reasonable; imperfect, but reasonable. But what happens if
the password "goes unused"? Will it be provided on stdin to the
program? That could be VERY bad in two ways (revealing the password,
and breaking the program's expectations).

ChrisA

[toc] | [prev] | [next] | [standalone]

#81591

On 11/26/2014 09:48 AM, Chris Angelico wrote:
> On Thu, Nov 27, 2014 at 2:36 AM, Tim Daneliuk <tundra@tundraware.com> wrote:
>> The more I think about this, the more I think I am just going to look for
>> the
>> string 'sudo' anywhere in the argument.  This merely will force the user to
>> enter their sudo password if detected.  If it turns out to be a false
>> positive,
>> no harm will be done and the password will just go unused.
>
> That sounds reasonable; imperfect, but reasonable. But what happens if
> the password "goes unused"? Will it be provided on stdin to the
> program? That could be VERY bad in two ways (revealing the password,
> and breaking the program's expectations).
>
> ChrisA


Nope.  Password only exist in memory locally.

If you want to see the whole program in action as it currently exists:

   http://www.tundraware.com/Software/tsshbatch

I do a lot of work in very large data centers where I need to execute a
bunch of commands across, say, a thousand servers.  tsshbatch has solved
the problem neatly for some years.  I'm just trying to knock some of
the rough edges off it :)

P.S. There are other such programs like 'capistrano' that are spiritually quite
      similar.  I wrote tsshbatch before I found out about the others, which
      are all written in other lanugages (like Ruby).  So, not only did
      this serve to solve my problem, it also taught me paramiko :)
-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81592

On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
> Nope.  Password only exist in memory locally.

How does it send it to the remote sudo?

[toc] | [prev] | [next] | [standalone]

#81594

On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>> Nope.  Password only exist in memory locally.
>
> How does it send it to the remote sudo?
>

Over paramiko transport (ssh) and then only if it sees a custom
string coming back from sudo asking for the pw.

-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81595

On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>> Nope.  Password only exist in memory locally.
>
> How does it send it to the remote sudo?
>

Over paramiko transport (ssh) and then only if it sees a custom
string coming back from sudo asking for the pw.

-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81596

On Thu, Nov 27, 2014 at 3:02 AM, Tim Daneliuk <tundra@tundraware.com> wrote:
> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
>>
>> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>>>
>>> Nope.  Password only exist in memory locally.
>>
>>
>> How does it send it to the remote sudo?
>>
>
> Over paramiko transport (ssh) and then only if it sees a custom
> string coming back from sudo asking for the pw.

So, it does get sent on stdin to whatever program is on the other end.

I would suggest a slightly safer approach: Instead of allowing a
password to be entered at the sudo prompt, first run "sudo -v" (maybe
-S as well to have it read stdin), which should be a self-contained
"prompt for sudo password" command. Then have the actual command run
as "sudo -n" for non-interactive mode. With most sane sudo setups,
that should work, and it'll guarantee (as long as your I/O streams are
separate for the separate programs) that the password will never be
sent to the wrong program.

Even so, I think your setup is pretty fragile. You'll do far better to
reconfigure sudo than to try to fiddle all this around.

ChrisA

[toc] | [prev] | [next] | [standalone]

#81597

On Wed, Nov 26, 2014, at 11:02, Tim Daneliuk wrote:
> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
> > On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
> >> Nope.  Password only exist in memory locally.
> >
> > How does it send it to the remote sudo?
> >
> 
> Over paramiko transport (ssh) and then only if it sees a custom
> string coming back from sudo asking for the pw.

So why not ask for the password only after seeing that string?

[toc] | [prev] | [next] | [standalone]

#81601

On 11/26/2014 10:16 AM, random832@fastmail.us wrote:
> On Wed, Nov 26, 2014, at 11:02, Tim Daneliuk wrote:
>> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
>>> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>>>> Nope.  Password only exist in memory locally.
>>>
>>> How does it send it to the remote sudo?
>>>
>>
>> Over paramiko transport (ssh) and then only if it sees a custom
>> string coming back from sudo asking for the pw.
>
> So why not ask for the password only after seeing that string?
>


Because this is a batch program. Once launched against hundreds or even
thousands of machines, no further user interaction is involved.
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81602

On 11/26/2014 10:16 AM, random832@fastmail.us wrote:
> On Wed, Nov 26, 2014, at 11:02, Tim Daneliuk wrote:
>> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
>>> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>>>> Nope.  Password only exist in memory locally.
>>>
>>> How does it send it to the remote sudo?
>>>
>>
>> Over paramiko transport (ssh) and then only if it sees a custom
>> string coming back from sudo asking for the pw.
>
> So why not ask for the password only after seeing that string?
>


Because this is a batch program. Once launched against hundreds or even
thousands of machines, no further user interaction is involved.
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81600

On Wed, 26 Nov 2014 10:02:57 -0600, Tim Daneliuk wrote:

> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
>> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>>> Nope.  Password only exist in memory locally.
>>
>> How does it send it to the remote sudo?
>>
>>
> Over paramiko transport (ssh) and then only if it sees a custom string
> coming back from sudo asking for the pw.

is it possible for you to post to either the news groout or the mailing 
list but not both?
all of your posts are currently doubled



-- 
If food be the music of love, eat up, eat up.

[toc] | [prev] | [next] | [standalone]

#81603

On 11/26/2014 10:45 AM, alister wrote:
> On Wed, 26 Nov 2014 10:02:57 -0600, Tim Daneliuk wrote:
>
>> On 11/26/2014 10:00 AM, random832@fastmail.us wrote:
>>> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote:
>>>> Nope.  Password only exist in memory locally.
>>>
>>> How does it send it to the remote sudo?
>>>
>>>
>> Over paramiko transport (ssh) and then only if it sees a custom string
>> coming back from sudo asking for the pw.
>
> is it possible for you to post to either the news groout or the mailing
> list but not both?
> all of your posts are currently doubled


Noted, fixed, sorry.
-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

#81593

On 11/26/2014 09:48 AM, Chris Angelico wrote:
> On Thu, Nov 27, 2014 at 2:36 AM, Tim Daneliuk <tundra@tundraware.com> wrote:
>> The more I think about this, the more I think I am just going to look for
>> the
>> string 'sudo' anywhere in the argument.  This merely will force the user to
>> enter their sudo password if detected.  If it turns out to be a false
>> positive,
>> no harm will be done and the password will just go unused.
>
> That sounds reasonable; imperfect, but reasonable. But what happens if
> the password "goes unused"? Will it be provided on stdin to the
> program? That could be VERY bad in two ways (revealing the password,
> and breaking the program's expectations).
>
> ChrisA


Nope.  Password only exist in memory locally.

If you want to see the whole program in action as it currently exists:

   http://www.tundraware.com/Software/tsshbatch

I do a lot of work in very large data centers where I need to execute a
bunch of commands across, say, a thousand servers.  tsshbatch has solved
the problem neatly for some years.  I'm just trying to knock some of
the rough edges off it :)

P.S. There are other such programs like 'capistrano' that are spiritually quite
      similar.  I wrote tsshbatch before I found out about the others, which
      are all written in other lanugages (like Ruby).  So, not only did
      this serve to solve my problem, it also taught me paramiko :)
-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | comp.lang.python

csiph-web