From 707c593761930016d00e7dbeb828e6f8c973622d Mon Sep 17 00:00:00 2001
From: Antoine Pitrou <solipsis@pitrou.net>
Date: Thu, 29 Jan 2009 20:19:34 +0000
Subject: [PATCH] Issue #2047: shutil.move() could believe that its destination
 path was inside its source path if it began with the same letters (e.g. "src"
 vs. "src.new").

---
 Lib/shutil.py           |  8 +++++++-
 Lib/test/test_shutil.py | 22 ++++++++++++++++++++++
 Misc/NEWS               |  4 ++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/Lib/shutil.py b/Lib/shutil.py
index ae2c66cef1e..cfb6646ad64 100644
--- a/Lib/shutil.py
+++ b/Lib/shutil.py
@@ -265,4 +265,10 @@ def move(src, dst):
             os.unlink(src)
 
 def destinsrc(src, dst):
-    return abspath(dst).startswith(abspath(src))
+    src = abspath(src)
+    dst = abspath(dst)
+    if not src.endswith(os.path.sep):
+        src += os.path.sep
+    if not dst.endswith(os.path.sep):
+        dst += os.path.sep
+    return dst.startswith(src)
diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
index fa5bbb1601f..6f65bdf6602 100644
--- a/Lib/test/test_shutil.py
+++ b/Lib/test/test_shutil.py
@@ -340,7 +340,29 @@ class TestMove(unittest.TestCase):
         dst = os.path.join(self.src_dir, "bar")
         self.assertRaises(shutil.Error, shutil.move, self.src_dir, dst)
 
+    def test_destinsrc_false_negative(self):
+        os.mkdir(TESTFN)
+        try:
+            for src, dst in [('srcdir', 'srcdir/dest')]:
+                src = os.path.join(TESTFN, src)
+                dst = os.path.join(TESTFN, dst)
+                self.assert_(shutil.destinsrc(src, dst),
+                             msg='destinsrc() wrongly concluded that '
+                             'dst (%s) is not in src (%s)' % (dst, src))
+        finally:
+            shutil.rmtree(TESTFN, ignore_errors=True)
 
+    def test_destinsrc_false_positive(self):
+        os.mkdir(TESTFN)
+        try:
+            for src, dst in [('srcdir', 'src/dest'), ('srcdir', 'srcdir.new')]:
+                src = os.path.join(TESTFN, src)
+                dst = os.path.join(TESTFN, dst)
+                self.failIf(shutil.destinsrc(src, dst),
+                            msg='destinsrc() wrongly concluded that '
+                            'dst (%s) is in src (%s)' % (dst, src))
+        finally:
+            shutil.rmtree(TESTFN, ignore_errors=True)
 
 def test_main():
     test_support.run_unittest(TestShutil, TestMove)
diff --git a/Misc/NEWS b/Misc/NEWS
index b9df27a6384..bce220754c1 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -145,6 +145,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #2047: shutil.move() could believe that its destination path was
+  inside its source path if it began with the same letters (e.g. "src" vs.
+  "src.new").
+
 - Issue 4920:  Fixed .next() vs .__next__() issues in the ABCs for
   Iterator and MutableSet.