python : file deletion using rm command

Question

I want to make sure that I delete required files. I have code something like

dir="/some/path/"
file = "somefile.txt"
cmd_rm= "rm -rf "+dir + file
os.system(cmd_rm)

The dir and file values are fetched from a database. How can I make sure I never end up running rm -rf /?

What things should I check before doing rm -rf?

Answer 1

You might consider using os.remove() instead since it's a great deal less dangerous than what you're attempting.

Answer 2

First, I suggest you to use the os.remove() and os.rmdir() functions for working with things like that. You will end up with more portable code and less headache for checking command return.

To check what you are effectively attempting to remove (you may not want to just check "/"), you can use some regular expressions on the generated path or just add a base path to all path returned from you database (depending what you are doing ...).

Answer 3

Don't use the -r switch if you just want to remove a single file. Also, there could be spaces in the file name.

Better use the functions in Python's os module instead:

dirname = "/some/path/"
filename = "somefile.txt"
pathname = os.path.abspath(os.path.join(dirname, filename))
if pathname.startswith(dirname):
   os.remove(pathname)

Normalizing the path with abspath and comparing it against the target directory avoids file names like "../../../etc/passwd" or similar.

Answer 4

There is a module called shutil that provides shell-like file manipulation. If you want to delete a directory and all files and directories in it then use shutil.rmtree.

However it is implemented in python so if you are deleting a huge number of files then spawning rm may be faster, but will fail if the path has a space in it.

Answer 5

Use shutil.rmtree as Dave Kirby says. If you want to delete the just the file use:

dir="/some/path/" 
file = "somefile.txt" 
cmd= os.path.join(dir, file) 
shutil.rmtree(cmd_rm) 

If you want to delete the directory use:

dir="/some/path/" 
file = "somefile.txt"  
shutil.rmtree(dir) 

If the files are write protected make sure you have write permissions before you run this.