Programming Forums > Script Programming > Python

Cerulean · Jan 24th, 2006, 4:12 PM

Quote:

Originally Posted by Arevos

Or use "os.path.basename". That should make things safe enough.

Yeah, os.path.basename is cool. Won't work, however, if you want to make use of subdirectories. Things need to stay flat if you use it.

Sane · Jan 24th, 2006, 4:55 PM

ColdDeath, you got my adminpass! GAHHHH! @_@

Oh nevermind, you can have it:

Quote:

self.adminpass = 'a3f10591cbb9f2f5587325837f57b3547fe40620'

It's encrypted in SHA-1 plus secret salt. Good luck trying to decode that.

Sane · Jan 24th, 2006, 7:52 PM

Oh, and by the way. All I did was make it look for '..' in the filename. Tell me if there's any way around this, or any exploits. Maybe like using %2E for a period or something.

I don't want to make the switch to os.path.basename yet. But from the sounds of it, is that just a variation of os.getcwd()?

Arevos · Jan 25th, 2006, 2:49 AM

Quote:

Originally Posted by Sane

I don't want to make the switch to os.path.basename yet. But from the sounds of it, is that just a variation of os.getcwd()?

Basename strips out the path leaving only the name of the file. e.g:

(Toggle Plain Text)

os.path.basename("somedirectory/../whatever/./filename.ext") -> "filename.ext"

Unless you want your users to be able to specify subdirectories, this would seem like the best solution.

Sane · Jan 25th, 2006, 5:10 PM

Why not just

(Toggle Plain Text)

filename.split(chr(92))[-1]

o_O??

Cerulean · Jan 25th, 2006, 5:21 PM

Because that's os specific - the os.path related functions work whether you're working with paths on Mac, Win, whatever. And why are you doing chr(92) instead of '\\'?
*scratches head*

Sane · Jan 25th, 2006, 5:37 PM

I've found chr(92) is more stable/consistent inside a literal and it makes it easier to search + replace (searching for \\ does some weird stuff if I recall correctly).

Cerulean · Jan 26th, 2006, 11:16 AM

By searching you mean something like "foo\\bar".find("\\")?

Arevos · Jan 26th, 2006, 3:01 PM

Quote:

Originally Posted by Sane

Why not just

(Toggle Plain Text)

filename.split(chr(92))[-1]

o_O??

Because Python is used by a large number of people, and developed by a number of experienced developers over a long period of time. If there were a security problem with basename, then someone would probably have found out by now.

If I have a choice between using a tried-and-tested function or writing it myself, I'd personally go with the tried-and-tested method, as there's less likelyhood of there being a mistake in the code.

Sane · Jan 26th, 2006, 5:39 PM

Ooh, that's weird when I tried it, it only works when you print the output. Not when you just let the shell return it.

That's weird.

Jan 25th, 2006, 5:10 PM	#15
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	Why not just (Toggle Plain Text) filename.split(chr(92))[-1] filename.split(chr(92))[-1] o_O??

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Jan 24th, 2006, 7:52 PM	#13
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	Oh, and by the way. All I did was make it look for '..' in the filename. Tell me if there's any way around this, or any exploits. Maybe like using %2E for a period or something. I don't want to make the switch to os.path.basename yet. But from the sounds of it, is that just a variation of os.getcwd()?

Jan 25th, 2006, 5:21 PM	#16
Cerulean Professional Programmer Join Date: Apr 2005 Location: London, England Posts: 459 Rep Power: 4	Because that's os specific - the os.path related functions work whether you're working with paths on Mac, Win, whatever. And why are you doing chr(92) instead of '\\'? scratches head

Jan 25th, 2006, 5:37 PM	#17
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	I've found chr(92) is more stable/consistent inside a literal and it makes it easier to search + replace (searching for \\ does some weird stuff if I recall correctly).

Jan 26th, 2006, 11:16 AM	#18
Cerulean Professional Programmer Join Date: Apr 2005 Location: London, England Posts: 459 Rep Power: 4	By searching you mean something like "foo\\bar".find("\\")?

Jan 26th, 2006, 5:39 PM	#20
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	Ooh, that's weird when I tried it, it only works when you print the output. Not when you just let the shell return it. That's weird.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Programming Forums > Script Programming > Python

PyCherry Help? Is this safe?