Running external commands safely from Python

Goal

Invoke command-line tools without shell injection, hangs or silently ignored failures.

Prerequisites

Knowledge of the exact executable and arguments; a decision about what happens when the tool fails.

Steps

1. Call subprocess.run([executable, arg1, arg2], ...) with a list; each argument is passed verbatim, so quoting problems and injection through spaces or metacharacters disappear.
2. Keep shell=False (the default). The documentation warns that shell=True with untrusted input enables shell injection; use it only for a fixed command string with no external data.
3. Set timeout= and handle subprocess.TimeoutExpired; a tool that hangs must not hang your service.
4. Capture output deliberately (capture_output=True, text=True) and bound what you keep; large outputs belong in files or streaming reads.
5. Use check=True or inspect returncode; a non-zero exit is a failure, not a warning.
6. Pass a minimal, explicit environment (env=) when secrets in the parent environment must not reach the child; never place secrets on the command line, where other processes can read them.

Expected result

Commands run with predictable arguments, fail loudly, and cannot be hijacked by file names or user input containing shell syntax.

Limits and test basis

Some tools interpret their own arguments (for example, options starting with -); prefix user-supplied paths with -- or validate them. Signals and process groups need extra care for long-running children. The rules follow the cited documentation.