Look into and test `shell=False`

[JoeZiminski]

It is typically a strong recommendation not to call subprocess with shell=True as there are security and performance implications. However, in practice I often get errors especially on Windows if shell=False. It might be worth handling this in a platform specific manner and reducing shell=True as much as possible.

[dhiraj-143r]

will u plz assign me this issue ?

[adamltyson]

Hi @dhiraj-143r, we don't typically assign issues to people other than core developers. If you would like to work on an issue, please either outline your apporach in the issue, or raise a PR so we can discuss. Thanks!

[dhiraj-143r]

Ok

[ishan372or]

Hi @JoeZiminski, Since the issue is still open, I was hoping to work on it and submit a PR with my findings to help drive further discussion. Please let me know if that sounds reasonable.

[JoeZiminski]

Hi @ishan372or sorry just saw this, sure please feel free to

[Davygupta47]

HI! @JoeZiminski, I noticed this issue is still not solved yet. I want to work on it and raise a PR with a solution for it. Can we have a discussion on it?

[JoeZiminski]

Hi @Davygupta47 thanks for this, this has been worked on a little in #659 and the working decision was to keep this as they are, because using shell=False creates a lot of complexity in the code and we determined they way we use it should not create any security issues. Please see #659 for the discussion, if you had some thoughts on this and / or also wanted to do some research into whether how we use shell=True in the codebase could create security issues, please feel free to join the discussion. Thanks!

[JoeZiminski]

See #639 for discussion, will close now.