Use subprocess to Avoid shell injection in shutil module

Merged Bitbucket Importer requested to merge bitbucket/merged-pr-628 into branch/default

Created originally on Bitbucket by Hervé Beraud (hervé beraud)

Was already merged in Bitbucket before import, marked as merged by the import user

Convert shutil._call_external_zip to use subprocess rather than distutlils.spawn


When shutil.make_archive falls back to te external zip problem, it use subprocess to invoke it rather than distutils.spawn.

This closes a possible shell injection vector. distutils.spawn isn't very good at quoting command lines.



Original pull-request on CPython:

Original-Author: Benjamin Peterson

Merge request reports