Fix shell=True security issues

[jasikpark]

Because the main repo contains functions with shell=True as parameters, the Codacy PR automated review fails on every pull request. Is there a way to turn this off or to fix the code so that Codacy is happy with it?

[alichtman]

We should remove all instances of shell=True and use shlex.split() for processing args, as shown in this link.

Do you want to open a PR, @jasikpark?

[alichtman]

I played around with this tonight and couldn't get any files to copy without the shell=True argument. I'm not sure how to solve this bug, but I remember running into it when I was working on this like 6 months ago and this was the best solution I had.

[jasikpark]

This stackoverflow explanation seems to imply that the calls to the shell should be broken up into individual programs to prevent needing to use shell=True, replicating the lost functionality natively in python.

So instead of

sp.run("ls {0}/.cargo/bin/ > {1}/cargo_list.txt".format(os.path.expanduser('~'), backup_path), shell=True, stdout=sp.PIPE)

we have

result = sp.run(["ls","{0}/.cargo/bin/"],stdout=sp.PIPE)

and result.stdout will store a byte string of the result of that shell call, which we can use python to store in the correct file.

getting stdout from running a program

[alichtman]

That sounds reasonable to me.

We should extract that to a method called run_shell_cmd(command).