Thread: ImageOptimizer
View Single Post
Old 02-03-2016, 10:58 AM   #20
eschwartz
Ex-Helpdesk Junkie
eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.eschwartz ought to be getting tired of karma fortunes by now.
 
eschwartz's Avatar
 
Posts: 19,421
Karma: 85400180
Join Date: Nov 2012
Location: The Beaten Path, USA, Roundworld, This Side of Infinity
Device: Kindle Touch fw5.3.7 (Wifi only)
Again, it works fine once I fixed the plugin.

The problem is that subprocess.Popen expects either:
  1. a list, and shell=False (shell defaults to false)
  2. a string, and shell=True

Passing a list to the shell means it tries to execute "jpegtran" and pass the additional arguments as arguments to the shell itself, not jpegtran.

And yes, when you run
Code:
jpegtran
it hangs.

Why on earth does it specifically need a shell? The plugin isn't using shell builtins, pipes, variable expansion, tilde expansion, or shell globbing. Plus it is now vulnerable to shell injection (not that this is the easiest way to mess with someone's computer and make them run malicious commands, but still, it's the theory of the thing...)

Last edited by eschwartz; 02-03-2016 at 11:01 AM.
eschwartz is offline   Reply With Quote