)]}'
{"glance/tests/unit/test_migrations.py":[{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"a5c76ded78f806e1828fbf636079ab34bdc265d6","unresolved":false,"context_lines":[{"line_number":167,"context_line":"    def _reset_databases(self):"},{"line_number":168,"context_line":"        def execute_cmd(cmd\u003dNone):"},{"line_number":169,"context_line":"            proc \u003d subprocess.Popen(cmd, stdout\u003dsubprocess.PIPE,"},{"line_number":170,"context_line":"                                    stderr\u003dsubprocess.STDOUT, shell\u003dTrue)"},{"line_number":171,"context_line":"            output \u003d proc.communicate()[0]"},{"line_number":172,"context_line":"            LOG.debug(output)"},{"line_number":173,"context_line":"            self.assertEqual(0, proc.returncode)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATn%2F%2BpRA%3D","line":170,"updated":"2013-11-22 02:48:13.000000000","message":"I know that these are tests however, if shell\u003dTrue is not needed why not skip it as it seems to be a security risk http://docs.python.org/2/library/subprocess.html#popen-constructor\n\nI pulled down this patch and ran the migration tests to see if they pass with shell\u003dFalse and it worked. Can you please use that here?","commit_id":"21510b1f35c1e3cc9e230ed1ff6af75c118f0d62"},{"author":{"_account_id":6722,"name":"ChangBo Guo(gcb)","email":"guochbo@cn.ibm.com","username":"guochbo"},"change_message_id":"94e0a64cae18b34f17711e77fd39644cee780e9e","unresolved":false,"context_lines":[{"line_number":167,"context_line":"    def _reset_databases(self):"},{"line_number":168,"context_line":"        def execute_cmd(cmd\u003dNone):"},{"line_number":169,"context_line":"            proc \u003d subprocess.Popen(cmd, stdout\u003dsubprocess.PIPE,"},{"line_number":170,"context_line":"                                    stderr\u003dsubprocess.STDOUT, shell\u003dTrue)"},{"line_number":171,"context_line":"            output \u003d proc.communicate()[0]"},{"line_number":172,"context_line":"            LOG.debug(output)"},{"line_number":173,"context_line":"            self.assertEqual(0, proc.returncode)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATn%2F%2BbEk%3D","line":170,"in_reply_to":"AAAATn%2F%2BpRA%3D","updated":"2013-11-26 09:24:17.000000000","message":"What \u0027s backend database you are using , From the code logic, mysql should work , but not work on postgresql.","commit_id":"21510b1f35c1e3cc9e230ed1ff6af75c118f0d62"},{"author":{"_account_id":6722,"name":"ChangBo Guo(gcb)","email":"guochbo@cn.ibm.com","username":"guochbo"},"change_message_id":"43bdd4801d0aed1ecd77fcf3b27386f68514135a","unresolved":false,"context_lines":[{"line_number":167,"context_line":"    def _reset_databases(self):"},{"line_number":168,"context_line":"        def execute_cmd(cmd\u003dNone):"},{"line_number":169,"context_line":"            proc \u003d subprocess.Popen(cmd, stdout\u003dsubprocess.PIPE,"},{"line_number":170,"context_line":"                                    stderr\u003dsubprocess.STDOUT, shell\u003dTrue)"},{"line_number":171,"context_line":"            output \u003d proc.communicate()[0]"},{"line_number":172,"context_line":"            LOG.debug(output)"},{"line_number":173,"context_line":"            self.assertEqual(0, proc.returncode)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATn%2F%2BoCQ%3D","line":170,"in_reply_to":"AAAATn%2F%2BpRA%3D","updated":"2013-11-22 10:01:48.000000000","message":"nikhil komawar,\n      Thanks for pointing out potential risk.  This is used  inner  method  with hardcode command here. \n\nAnd see line  217, we maybe need shell feature. need shell\u003dTrue.\n\nThis is a simple example show that  it will fail without shell \u003dTrue.\n\n  #!/usr/bin/env python\nimport subprocess\ncmd \u003d \"echo haha \u003e ./mydata.txt \u0026\u0026 chmod 0600 ./mydata.txt\"\nproc \u003d subprocess.Popen(cmd, stdout\u003dsubprocess.PIPE, stderr\u003dsubprocess.STDOUT)\n(output, output_err) \u003d proc.communicate()\nprint(proc.returncode)\nprint(output)\nprint(output_err)","commit_id":"21510b1f35c1e3cc9e230ed1ff6af75c118f0d62"}]}