title: Sanitized input for subprocess with shell=True in python
body: <p>I have python script, which has code.</p>
  
  <pre><code>...
  ...
  p = subprocess.Popen(cmd,
                       stdout=subprocess.PIPE,
                       stderr=subprocess.PIPE,
                       shell=True)
  output, error = p.communicate()
  ...
  ...
  </code></pre>
  
  <p>When I run <a href="https://github.com/openstack/bandit" rel="nofollow"><code>bandit</code></a> it gives error.</p>
  
  <pre><code>&gt;&gt; Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
     Severity: High   Confidence: High
     Location: mypackage/myfile.py:123
  123                                          stderr=subprocess.PIPE,
  124                                          shell=True)
  125                     output, error = p.communicate()
  </code></pre>
  
  <p>Then I do some google, and found that, I have to sanitized my input and with <a href="https://docs.python.org/3/library/shlex.html#shlex.split" rel="nofollow"><code>shlex.split</code></a> and <a href="https://docs.python.org/3/library/shlex.html#shlex.quote" rel="nofollow"><code>shlex.quote</code></a> I can sanitize it.</p>
  
  <p>I changed my code to.</p>
  
  <pre><code>...
  ...
  p = subprocess.Popen(shlex.split(shlex.quote(cmd)),
                       stdout=subprocess.PIPE,
                       stderr=subprocess.PIPE,
                       shell=True)
  output, error = p.communicate()
  ...
  ...
  </code></pre>
  
  <p>But still I get same error, is there any way to remove this error when run <code>bandit -r mypackage/myfile.py</code> </p>