title: Python Subprocess Security
body: <p>I understand why using 'shell=True' can be a security risk if you have untrusted input.  However, I don't understand how 'shell=False' avoids the same risks.  </p>
  
  <p>Presumably if I wanted to allow a user to provide an input he might input: var="rm -rf /"</p>
  
  <p>My code might simply:</p>
  
  <pre><code>subprocess.call(var,shell=True) # bad stuff
  </code></pre>
  
  <p>Or I might do:</p>
  
  <pre><code>varParts=var.split()
  subprocess.call(varParts,shell=False) # also bad, right?
  </code></pre>
  
  <p>It would seem that the assumption is one wouldn't go through the trouble of processing the input as I did in the second example and therefore this would/could not happen?</p>