🔗 Shelling out is selling out

August 03, 2025 Do you write Python code? Do you often need to invoke programs from your Python code that are - shockingly - not written in Python?

Have you written code that looks like this?

def process_data(data: bytes) -> bytes:
    # Create a new directory to store input and output data:
    with tempfile.TemporaryDirectory() as tempdir:

        # Write to disk:
        infile = os.path.join(tempdir, "input.bin")
        with open(infile, "wb") as f:
            f.write(data)

        # Start a subprocess and have it read our input file:
        outfile = os.path.join(tempdir, "output.bin")
        subprocess.check_call(["processor", infile, outfile])

        # Read from disk:
        with open(outfile, "rb") as f:
            return f.read()

I understand. Not everything is written in Python. Do this if you need to get something done right away.

But I've started disallowing code like this in my own codebases, for one main reason (and may other reasons too): it's full of footguns.