Merge pull request #31 from asottile/parent_directories

Correctly check parent directories

aactivator.py

@@ -96,6 +96,7 @@ def insecure(path):
 
 
 def search_parent_paths(path):
+    path = os.path.abspath(path)
     original_fs_id = fs_id = get_filesystem_id(path)
     previous_path = None
     while original_fs_id == fs_id and path != previous_path:

tests/integration_test.py

@@ -254,6 +254,30 @@ def test_complains_when_not_activated(activate, venv_path, tmpdir, shell):
     run_test(shell, test, tmpdir)
 
 
+def test_complains_parent_directory_insecure(venv_path, tmpdir, shell):
+    make_venv_in_tempdir(tmpdir)
+    venv_path.chmod(0o777)
+
+    test = '''\
+TEST> eval "$(aactivator init)"
+TEST> echo
+
+TEST> cd {venv_path}
+aactivator will source .activate.sh and .deactivate.sh at {venv_path}.
+Acceptable? (y)es (n)o (N)ever: INPUT> y
+aactivator will remember this: ~/.cache/aactivator/allowed
+aactivator: Cowardly refusing to source .activate.sh because writeable by others: .
+TEST> echo
+
+aactivator: Cowardly refusing to source .activate.sh because writeable by others: .
+TEST> cd /
+TEST> echo
+
+'''
+    test = test.format(venv_path=str(venv_path))
+    run_test(shell, test, tmpdir)
+
+
 def test_activate_but_no_deactivate(venv_path, tmpdir, deactivate, shell):
     make_venv_in_tempdir(tmpdir)
     deactivate.remove()