Variable interpolation into shell commands is unsafe

[rgov]

I see code like this:

subprocess.call(
    'cd "%s" && %s %s%s "%s"' % (
        gcov_root, args.gcov, args.gcov_options, local_gcov_options, path),
    shell=True)

You should wrap these in strings in calls to pipes.quote (Python 2.7) or shlex.quote (Python 3.3).

It would probably be OK to not execute this in a shell, by the way, and just set the cwd argument. No quoting necessary.

Also the check_call method will raise an exception if the subcommand failed, which might be useful to know.

[chrisosaurus]

Patches of course welcome.

cpp-coveralls currently targets pypy, 2.7, 3.4, and 3.5 [1]
Is there a quoting option that supports both python2 and python3 ?

As you mentioned, it may make more sense to use a python-native cd equivalent.

[1] https://github.com/eddyxu/cpp-coveralls/blob/master/.travis.yml#L3