web interface fails when filenames has whitespace

[carandraug]

Because of the way the command is generated and called, the web interface fails when there's whitespace. Currently code does something like:

my $command = "python script.py -in $filename"
my $output = `$command`

The easiest way out is to simply quote $filename but that will cause problems if the filename has quotes. A good way out is to use system() but then it doesn't capture stdout. A better way out would be to use IPC::Open2 but that complicates things. An easier way out would be too use a hardcoded filename when uploading the filename but then the output will make less sense to the user.

[darogan]

I've not used IPC::Open2 - how does it complicate things? Is it worth the investment for me to implement it?

[carandraug]

It's not much more complicated, it just involves more coding. I would actually prefer a mix of using Open2 with using fixed filenames. Note that the filename coming from the web interface should be considered tainted and not used at all (on that note, is there any reason why it is not running on tainted mode?).

Using a fixed name would also prevent other issues such as uploading two different files with the same name. I'm also unsure on how the actual python and it's R interface will handle filepaths.