Let third_party/crashpad/update.py work on Windows

Let third_party/crashpad/update.py work on Windows

`git` is a batch file on Windows, so needs to be run via cmd.

R=mark@chromium.org
BUG=472900
Committed: https://crrev.com/609f6c2764bc7c96999537d68b09792dd5482282
Cr-Commit-Position: refs/heads/master@{#367873}

[Mark Mentovai, 2016-01-06 18:47:12]

LGTM, although I’m afraid of shell=True without escaping for it.

[scottmg, 2016-01-06 18:49:12]

On 2016/01/06 18:47:12, Mark Mentovai wrote:
> LGTM, although I’m afraid of shell=True without escaping for it.

Which type of escaping? The subprocess module handles command line escaping when
it's used with a list for args.

[scottmg, 2016-01-06 18:49:45]

The CQ bit was checked by scottmg@chromium.org

[commit-bot: I haz the power, 2016-01-06 18:50:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1561213002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1561213002/20001

[Mark Mentovai, 2016-01-06 18:58:37]

scottmg wrote:
> On 2016/01/06 18:47:12, Mark Mentovai wrote:
> > LGTM, although I’m afraid of shell=True without escaping for it.
> 
> Which type of escaping? The subprocess module handles command line escaping
when
> it's used with a list for args.

https://docs.python.org/2/library/subprocess.html#frequently-used-arguments

> If shell is True, the specified command will be executed through the
> shell.
[…]
> Warning: Executing shell commands that incorporate unsanitized input
> from an untrusted source makes a program vulnerable to shell
> injection, a serious security flaw which can result in arbitrary
> command execution. For this reason, the use of shell=True is strongly
> discouraged in cases where the command string is constructed from
> external input:
[…]
> When using shell=True, pipes.quote() can be used to properly escape
> whitespace and shell metacharacters in strings that are going to be
> used to construct shell commands.

pipes.quote does sh-type escaping, not cmd-type escaping, though.

[commit-bot: I haz the power, 2016-01-06 19:17:10]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-01-06 19:18:15]

Description was changed from

==========
Let third_party/crashpad/update.py work on Windows

`git` is a batch file on Windows, so needs to be run via cmd.

R=mark@chromium.org
BUG=472900
==========

to

==========
Let third_party/crashpad/update.py work on Windows

`git` is a batch file on Windows, so needs to be run via cmd.

R=mark@chromium.org
BUG=472900

Committed: https://crrev.com/609f6c2764bc7c96999537d68b09792dd5482282
Cr-Commit-Position: refs/heads/master@{#367873}
==========

[commit-bot: I haz the power, 2016-01-06 19:18:15]

Patchset 2 (id:??) landed as
https://crrev.com/609f6c2764bc7c96999537d68b09792dd5482282
Cr-Commit-Position: refs/heads/master@{#367873}