Quote packages in pip install to avoid shell expansion (#529)

* Quote packages in pip install to avoid shell expansion

Without quotes, pip installs with versioning that includes
characters '<', '>', or '|' result in shell expansion and
creation of unwanted files

Signed-off-by: Dylan Eustice <deustice@nvidia.com>

* Update unit tests to expect quotes

* Use shlex_quotes from six.moves instead of f-string and update unit tests

Signed-off-by: Dylan Eustice <deustice@nvidia.com>

---------

Signed-off-by: Dylan Eustice <deustice@nvidia.com>

Author: dylan-eustice

hpccm/building_blocks/pip.py

@@ -24,6 +24,7 @@
 from packaging.version import Version
 import logging
 import posixpath
+from six.moves import shlex_quote
 
 import hpccm.config
 import hpccm.templates.rm
@@ -165,6 +166,8 @@ def __instructions(self):
                                    posixpath.basename(self.__requirements))]))
 
             if self.__packages:
+                # Quote the packages to avoid shell expansion
+                quoted_packages = [shlex_quote(pkg) for pkg in self.__packages]
                 cmds.append('{0} install {1}'.format(self.__pip,
-                                                     ' '.join(self.__packages)))
+                                                     ' '.join(quoted_packages)))
             self += shell(commands=cmds)

test/test_pip.py

@@ -166,3 +166,12 @@ def test_upgrade(self):
     rm -rf /var/lib/apt/lists/*
 RUN pip --no-cache-dir install --upgrade "pip < 21.0" && \
     pip --no-cache-dir install hpccm''')
+
+    @ubuntu
+    @docker
+    def test_package_with_version(self):
+        """package with version specifier is quoted"""
+        p = pip(ospackages=[], packages=['hpccm>=1.0'])
+        self.assertEqual(str(p),
+r"""# pip
+RUN pip --no-cache-dir install 'hpccm>=1.0'""")