Use subprocess to Avoid shell injection in shutil module

Merged Bitbucket Importer requested to merge bitbucket/merged-pr-628 into branch/default

Created originally on Bitbucket by Hervé Beraud (hervé beraud)

Was already merged in Bitbucket before import, marked as merged by the import user

Convert shutil._call_external_zip to use subprocess rather than distutlils.spawn

Subject

When shutil.make_archive falls back to te external zip problem, it use subprocess to invoke it rather than distutils.spawn.

This closes a possible shell injection vector. distutils.spawn isn't very good at quoting command lines.

CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-1000802

Resolve: https://bugs.python.org/issue34540

Original pull-request on CPython: https://github.com/python/cpython/pull/8985

Original-Author: Benjamin Peterson benjamin@python.org

Merge request reports