🔒 How can i make this better pt2 lol

[fast summit]

import os
import sys

UAFN={}
with open(sys.argv[1], "r") as file:
    for line in file:
        if ".js" in line:
            line=line.split(" ")
            file_path=line[6][1:]
            file_name=file_path.split("/")[1]
            url=line[10].strip('"')
            unique_suffix=url.split("http://")[1].replace("/","_")
            domain=url.split("/")[2]
            full_url=f"{url}{file_path}"
            unique_file_name=f"{unique_suffix}_{file_name}"
            unique_file_name.replace("-","_",1)
            print(domain)
            print(file_name)
            print(file_path)
            print(unique_file_name)
            print(url)
            print(full_url)
            print(line[6] ,line[10])

            UAFN[full_url]=unique_file_name


for d,n in UAFN.items():
    os.system(f"wget -O {n} {d}")

[jaunty lantern]

@fast summit

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[remote lichen]

First thing i'd say is add some whitespace

Also I'd switch the if statement to a guard clause, so ```py
if '.js' not in line:
continue
... # The rest of the code that is curently in the if statement

[ocean stag]

Comments, so that we know what it's supposed to do?

[remote lichen]

Also, I'd add a check that sys.argv[1] actually exists, as right now if you run the program but don't pass anything you'll get an IndexError

[remote lichen]

Also final thing, there seems to be a lot of magic values, i.ee line[10], with no context as to what it is/no validation it is what it should be.

[ocean stag]

This one doesn't bother me - the failure will be very obvious. A real CLI script, sure, nicer checker and polite messages.

[fast summit]

Oh i see yes this some sort of exercise i have to do in python but basically i did it in bash and then were told to write in python. Its to locate all .js files in a http server log and then download them with a unique name but yeah i dont know much python so i just wanted tips on how to clean it up

looks like more comments and also the check for validating that its given an argument

[ocean stag]

I find a good opening thing is to include a sample of a source line as one of the comments so that it's clear what kind of text you're working against.

[fast summit]

i assume i could of made it like more detailed but yeah what does this do? just skip or something

[remote lichen]

Also due to the lack of context it's hard to say if this is a valid worry or not, but depending on how this is ran, if a malicious user is able to set n and d to whatever they want, they could escape the wget command and get arbitrary code execution.

[ocean stag]

It just skips to the next loop iteration i.e. the next line. Avoids the indent of the code below.

[remote lichen]

Basically instead of having everything within the if statement, simply go to the next item in the loop if .js is not in the line.

[ocean stag]

Particularly, embedded strings in commands blithely allows injection attacks. You want to invoke wget using subprocess.run with the command words are a list. Or even just use the requests third party package to fetch the URLs.

[fast summit]

You mean like assuming this script is ran on some sort of cronjob? you mean like log poisoning?

[ocean stag]

Injection attacks.
https://xkcd.com/327/

xkcd: Exploits of a Mom

Her daughter is named Help I'm trapped in a driver's license factory.

[vague rapids]

i reccomend pathlib instead of os

it works better

[remote lichen]

If a malicious user is able to control the unique_file_name variable or full_url variable, from what I can tell can run whatever they want.

[ocean stag]

And in this case, that means: malicious user contriving to put bad things in a log file.

... not by hacking the log file, but by feeding things to whatever's doing the logging.

[remote lichen]

As they said, you can run it with subprocess.run or even better (imo) use the library requests or built in library urllib, Which both should be fairly easy to setup in this context.

[raw ravine]

pathlib replaces mostly the functions from os.path: https://docs.python.org/3/library/pathlib.html#corresponding-tools
os contains a lot more functions, e.g. os.system runs shell commands (...though it should probably be replaced with subprocess.run)

[vague rapids]

for d, n in UAFN.items(): Path(n).write_text(Path(d).read_text())

[raw ravine]

That's not what wget does

[vague rapids]

🤷

[raw ravine]

unless Path has gained HTTP capabilities while I wasn't looking 🙂

[ocean stag]

Would you want it to? Seems ... fraught.

[raw ravine]

that would be cursed

[remote lichen]

I mean the ellipses class doesn't really have any uses other than a place holder afaik, why not make it callable to make http requests too?

I mean think about how much you could condense your code if they added this:

....get("https://thisisjustwrong.com")

gotta test if the tokenizer can handle a 4th dot lol

[fast summit]

I will try to keep these things in mind lol i dont know much of coding but its good to know that this can happen. I will try to fix it up with what you guys have recommended

[ocean stag]

https://en.wikipedia.org/wiki/James_while_John_had_had_had_had_had_had_had_had_had_had_had_a_better_effect_on_the_teacher

[remote lichen]

!e

print(....__init__())

[jaunty lantern]

:white_check_mark: Your 3.12 eval job has completed with return code 0.

None

[remote lichen]

i love this

[remote lichen]

im stressed

I'll stick with Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo

[fast summit]

!close

[jaunty lantern]

Python help channel closed with !close

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.