We Keep Coding

Preventing my script from os command injection python

i am using python 2.7.x
I automating my stuffs and in there i need run to another python program from my python script for that i am using the system function from the 'os' library.
for e.g:
import os
os.system("python anotherscript.py --data <USER_INPUT_FROM_MY_SCRIPT_HERE>")
so i know if any user inputs some other command in place of expected user input that will be converting to os command injection and that's what i want prevent in this case.
Thank you.

Since you need to run a Python script from Python, just import it the Python way and invoke the needed function normally
import anotherscript
anotherscript.<function>("<user_input>")

#Tenchi2xh's answer is the better way to do it, but if that doesn't work (e.g. your script only works on Python 2.x and the other one only works on Python 3.x) then you should use the subprocess module, passing the arguments as a list:
import subprocess
subprocess.call(['python', 'anotherscript.py', '--data', '<USER INPUT>'])
Also take a look at subprocess.check_call and subprocess.check_output to see if they are closer to what you need.
https://docs.python.org/2/library/subprocess.html#subprocess.call

executing OS commands from python using modules

I want to run a python script that can execute OS (linux) commands , I got few modules that helps me in doing that like os, subprocess . In OS module am not able to redirect the output to a variable . In subprocess.popen am not able to use variable in the arguments. Need someone help in finding the alternative .
Am trying to run some OS commands from python script . for example df -h output. It works fine with by using some modules like os or subprocess .But am not able to store those output to any variable .
Here am not able to save this output to a variable . How do I save this to a variable.
i saw multiple other options like subprocess.Popen but am not getting proper output.
Below program i used subprocess module but here I have another issue , as the command is big am not able to use variables in subprocess.Popen.

You can use the subprocess method check_output
import subprocess
output = subprocess.check_output("your command", shell=True)
see previously answered SO question here for more info: https://stackoverflow.com/a/8659333/3264217
Also for more info on check_output, see python docs here:
https://docs.python.org/3/library/subprocess.html#subprocess.check_output

Use either subprocess or pexpect depending on what is your exact use case.
subprocess can do what os.system does and much more. If you need to start some command, wait for it to exit and then get the output, subprocess can do it:
import subprocess
res = subprocess.check_output('ls -l')
But if you need to interact with some command line utility, that is repeatedly read/write, then have a look at pexpect module. It is written for Unix systems but if you ever want to go cross-platform, there is a port for Windows called winpexpect.
spawn's attribute 'before' is probably what you need:
p = pexpect.spawn('/bin/ls')
p.expect(pexpect.EOF)
print p.before
(see the docs)

How to give multiple GDB commands through subprocess?

I need to give Gdb commands after I have started running a shell script which invokes gdb and halts to the Gdb prompt. So, to load and execute the image (.elf) file I invoke the following subprocess:
import subprocess
os.chdir(r"/project/neptune_psv/fw/")
print os.getcwd()
proc = subprocess.Popen('./Execute.sh -i TestList_new.in -m 135.20.230.160 -c mpu',shell = True,stdin = subprocess.PIPE)
After Execute.sh halts to the Gdb prompt I need to give two Gdb commands:
Set *0x44880810 = 3 (Set a register value)
Continue
Can anyone help me how to give these two commands through stdin ?

I think the simplest way is to use something like pexpect, an expect clone in Python. This provides a way to control an otherwise interactive process programmatically.
However, since you're specifically using gdb, note that this is not the best approach to driving gdb. There are two better ways. First, you can program gdb directly using its built-in Python API. This is the best way, if it is possible for your use case, as it is a lot simpler than trying to parse the output. However, if you must parse the output, then you should investigate "MI". This is gdb's "Machine Interface", which presents a vaguely JSON-like (it predates the real JSON) way to control gdb. There are MI parsing libraries available, though offhand I don't recall if there is one written in Python.

Running command lines within your Python script

So I have a bunch of aliases and Command Line prompt programs, and my main program works by inputting b into the cmd.exe, followed by some filepath names and what not. How would I run those arguments in my python script? So that it mimics the action i am doing in the cmd?

You should use the subprocess module. In particular, subprocess.call will run command line programs for you.

or you can use
import os
os.system('your_command')
for example:
import os
os.system('notepad')
will launch the notepad with the command line behind.
hope this helps

You can do this using subprocess
For example, this call bellow gets the output of the program and stores it as a string, using .call will help with calling it and for more accurate control use .Popen
subprocess.check_output(["ipconfig"])

Check out Sarge - a wrapper for subprocess which aims to make life easier for anyone who needs to interact with external applications from their Python code. and Plumbum - a small yet feature-rich library for shell script-like programs in Python.

Is it possible to use batch scripts in a GUI made with Python?

I was wondering if it was possible to write a GUI in python, and then somewhere in the python script, insert a script switch to temporarily change the language to accomodate for the batch snippet.
I know this can be done in html and vbscript but what about Python?

You can control other processes, written with any language, including bash using the subprocess module.

The subprocess module is the most powerful and complete method for executing other processes. However, there's also a very simple method using the os module: os.system(command) runs command just as if you were to type it into a command line.