From f92ee329a93336adaba4650efb1af63ec52ddb39 Mon Sep 17 00:00:00 2001
From: Nick Hall <nick-h@gramps-project.org>
Date: Fri, 24 Feb 2017 22:26:55 +0000
Subject: [PATCH] Avoid using 'shell=True' when running a subprocess

---
 gramps/cli/test/cli_test.py                      | 14 ++++++--------
 gramps/gen/git_revision.py                       |  9 ++++-----
 gramps/plugins/export/test/exportvcard_test.py   |  8 ++++----
 gramps/plugins/importer/test/importvcard_test.py | 13 +++++++------
 4 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/gramps/cli/test/cli_test.py b/gramps/cli/test/cli_test.py
index 59eb9cd70..e4955c3c6 100644
--- a/gramps/cli/test/cli_test.py
+++ b/gramps/cli/test/cli_test.py
@@ -77,14 +77,13 @@ class Test(unittest.TestCase):
     # This tests the fix for bug #1331-1334
     # read trivial gedcom input, write gedcom output
     def test2_exec_CLI(self):
-        pyexec = sys.executable
         ifile = min1r
         ofile = out_ged
-        gcmd = "Gramps.py -i %s -e %s" % (ifile, ofile)
-        process = subprocess.Popen("%s %s" % (pyexec, gcmd),
+        gcmd = [sys.executable, "Gramps.py", "-i", ifile, "-e", ofile]
+        process = subprocess.Popen(gcmd,
                                    stdin=subprocess.PIPE,
                                    stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE, shell=True)
+                                   stderr=subprocess.PIPE)
         result_str, err_str = process.communicate()
         self.assertEqual(process.returncode, 0,
                          "executed CLI command %r" % gcmd)
@@ -110,14 +109,13 @@ class Test(unittest.TestCase):
                 f.write("garbage")
 
         # ~same as test 2
-        pyexec = sys.executable
         ifile = min1r
         ofile = out_ged
-        gcmd = "Gramps.py -i %s -e %s" % (ifile, ofile)
-        process = subprocess.Popen("%s %s" % (pyexec, gcmd),
+        gcmd = [sys.executable, "Gramps.py", "-i", ifile, "-e", ofile]
+        process = subprocess.Popen(gcmd,
                                    stdin=subprocess.PIPE,
                                    stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE, shell=True)
+                                   stderr=subprocess.PIPE)
         result_str, err_str = process.communicate()
         self.assertEqual(process.returncode, 0,
                          "executed CLI command %r" % gcmd)
diff --git a/gramps/gen/git_revision.py b/gramps/gen/git_revision.py
index 93cc10148..87720455b 100644
--- a/gramps/gen/git_revision.py
+++ b/gramps/gen/git_revision.py
@@ -30,12 +30,11 @@ def get_git_revision(path=""):
     Return the short commit hash of the latest commit.
     """
     stdout = ""
-    command = "git log -1 --format=%h"
+    command = ['git', 'log', '-1', '--format=%h', path]
     try:
-        proc = subprocess.Popen(
-            "{} \"{}\"".format(command, path),
-            shell=True,
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        proc = subprocess.Popen(command,
+                                stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE)
         (stdout, stderr) = proc.communicate()
     except OSError:
         return "" # subprocess failed
diff --git a/gramps/plugins/export/test/exportvcard_test.py b/gramps/plugins/export/test/exportvcard_test.py
index 03cea0ead..6489dd0e8 100644
--- a/gramps/plugins/export/test/exportvcard_test.py
+++ b/gramps/plugins/export/test/exportvcard_test.py
@@ -71,13 +71,13 @@ class VCardCheck(unittest.TestCase):
         if debug:
             print(ET.tostring(input_doc))
 
-        pyexec = sys.executable
-        gcmd = 'Gramps.py -i - -f gramps -e - -f vcf'
-        process = subprocess.Popen('%s %s' % (pyexec, gcmd),
+        gcmd = [sys.executable, 'Gramps.py',
+                '-i', '-', '-f', 'gramps',
+                '-e', '-', '-f', 'vcf']
+        process = subprocess.Popen(gcmd,
                                    stdin=subprocess.PIPE,
                                    stdout=subprocess.PIPE,
                                    stderr=subprocess.PIPE,
-                                   shell=True,
                                    env=os.environ)
         input_str = (self.header.encode('utf-8') +
                      ET.tostring(input_doc, encoding='utf-8'))
diff --git a/gramps/plugins/importer/test/importvcard_test.py b/gramps/plugins/importer/test/importvcard_test.py
index 509865030..984140f3a 100644
--- a/gramps/plugins/importer/test/importvcard_test.py
+++ b/gramps/plugins/importer/test/importvcard_test.py
@@ -77,15 +77,16 @@ class VCardCheck(unittest.TestCase):
     def do_case(self, input_str, expect_doc, debug=False):
         if debug:
             print(input_str)
-        pyexec = sys.executable
-        gcmd = ('Gramps.py -d .Date -d .ImportVCard '
-                '--config=preferences.eprefix:DEFAULT '
-                '-i - -f vcf -e - -f gramps')
-        process = subprocess.Popen('%s %s' % (pyexec, gcmd),
+
+        gcmd = [sys.executable, 'Gramps.py',
+                '-d', '.Date', '-d', '.ImportVCard',
+                '--config=preferences.eprefix:DEFAULT',
+                '-i', '-', '-f', 'vcf',
+                '-e', '-', '-f', 'gramps']
+        process = subprocess.Popen(gcmd,
                                    stdin=subprocess.PIPE,
                                    stdout=subprocess.PIPE,
                                    stderr=subprocess.PIPE,
-                                   shell=True,
                                    env=os.environ)
         result_str, err_str = process.communicate(input_str.encode("utf-8"))
         if debug: