import os

command = "conda run -n python3.5 python generate_handwriting.py -text '{}' -style {} -bias {} -stroke_color '{}' -stroke_width {} -output '{}'".format(text, style, bias, stroke_color, stroke_width, output_filename)


os.system(command)

I get the variables, for example text, directly from the user. I’ve been notified that this could allow the user to execute malicious code. I have rewritten the code to this:

import subprocess

cmd = ["conda", "run", "-n", "python3.5", "python", "generate_handwriting.py"]
args = ["-text", str(text), "-style", str(style), "-bias", str(bias), "-stroke_color", str(stroke_color), "-stroke_width", str(stroke_width), "-output", output_filename]

process = subprocess.run(cmd + args, check=True)

Is the issue fixed now?

The full code can be found here.