Skip to content

Commit 5b8493d

Browse files
committed
fix: Quote CL cmd in iCmd5250 for shell escaping
iCmd5250 is just a fancy wrapper around iSh, using the PASE system command. It did not do any shell escaping/quoting, so it basically only allowed calling CL commands without parameters or with only positional parameters because the parentheses would cause the shell to gack. eg. iCmd5250('wrkactjob', 'WRKACTJOB SBS(QBATCH)') basically became iSh('wrkactjob', '/QOpenSys/usr/bin/system WRKACTJOB SBS(QBATCH)') When executed, an error would be given from the shell: sh: syntax error at line 1 : `(' unexpected The proper fix is to quote the string, but that can be tricky to get right. Luckily, Python has shlex.quote to do the hard work for us. https://docs.python.org/3/library/shlex.html#shlex.quote Fixes #49
1 parent 0afda17 commit 5b8493d

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

src/itoolkit/itoolkit.py

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,13 @@ class iXml(iBase): IBM i XMLSERVICE raw xml input
113113
import re
114114
import time
115115

116+
try:
117+
from shlex import quote
118+
except ImportError:
119+
# python2 has shlex, but not shlex.quote
120+
# Implement a crude equivalent. We don't care about Python 2 that much
121+
def quote(s):
122+
return '"{}"'.format(s)
116123

117124
class iBase(object): # noqa N801
118125
"""
@@ -329,7 +336,7 @@ class iCmd5250(iSh): # noqa N801
329336
"""
330337

331338
def __init__(self, ikey, icmd, iopt={}):
332-
cmd = "/QOpenSys/usr/bin/system " + icmd
339+
cmd = "/QOpenSys/usr/bin/system " + quote(icmd)
333340
super(iCmd5250, self).__init__(ikey, cmd, iopt)
334341

335342

0 commit comments

Comments
 (0)