
Security News
AI Slop Is Polluting Bug Bounty Platforms with Fake Vulnerability Reports
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.
.. image:: https://img.shields.io/pypi/v/shellingham.svg :target: https://pypi.org/project/shellingham/
Shellingham detects what shell the current Python executable is running in.
.. code-block:: python
>>> import shellingham
>>> shellingham.detect_shell()
('bash', '/bin/bash')
detect_shell
pokes around the process's running environment to determine
what shell it is run in. It returns a 2-tuple:
ShellDetectionFailure
is raised if detect_shell
fails to detect the
surrounding shell.
Remember, your application's user is not necessarily using a shell.
Shellingham raises ShellDetectionFailure
if there is no shell to detect,
but your application should almost never do this to your user.
A practical approach to this is to wrap detect_shell
in a try block, and
provide a sane default on failure
.. code-block:: python
try:
shell = shellingham.detect_shell()
except shellingham.ShellDetectionFailure:
shell = provide_default()
There are a few choices for you to choose from.
SHELL
to refer to
"the user's preferred command language interpreter". This is always available
(even if the user is not in an interactive session), and likely the correct
choice to launch an interactive sub-shell with.sh
is almost guaranteed to exist, likely at /bin/sh
, since
several POSIX tools rely on it. This should be suitable if you want to run a
(possibly non-interactive) script.COMSPEC
.
This can always be used to launch a usable command prompt (e.g. cmd.exe
on
Windows).Here's a simple implementation to provide a default shell
.. code-block:: python
import os
def provide_default():
if os.name == 'posix':
return os.environ['SHELL']
elif os.name == 'nt':
return os.environ['COMSPEC']
raise NotImplementedError(f'OS {os.name!r} support not available')
FAQs
Tool to Detect Surrounding Shell
We found that shellingham demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.
Research
Security News
The Socket Research team investigates a malicious Python package disguised as a Discord error logger that executes remote commands and exfiltrates data via a covert C2 channel.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.