I'm developing an app with Tkinter as the UI. Currently, I'm using tkinter.filedialog's askopenfilename function to let a user choose a file. I then create a hidden file for [redacted] purposes with the same filename. As a result, I need to use subprocess which I've read can have suffer from command injection vulnerabilities if the input is not sanitized. So far, I've done pretty minor sanitization and before I get down the weeds, I wanted to find out: does askopenfilename already pretty sanitized/safe? Or should I treat it as unsanitized as an input statement? The docs only say this: tkinter.filedialog.askopenfilename(**options) tkinter.filedialog.askopenfilenames(**options) The above two functions create an Open dialog and return the selected filename(s) that correspond to existing file(s). Continue reading...
