Issue #2047: shutil.move() could believe that its destination path was

inside its source path if it began with the same letters (e.g. "src" vs.
"src.new").

Lib/shutil.py

@@ -265,4 +265,10 @@ def move(src, dst):
             os.unlink(src)
 
 def destinsrc(src, dst):
-    return abspath(dst).startswith(abspath(src))
+    src = abspath(src)
+    dst = abspath(dst)
+    if not src.endswith(os.path.sep):
+        src += os.path.sep
+    if not dst.endswith(os.path.sep):
+        dst += os.path.sep
+    return dst.startswith(src)

Lib/test/test_shutil.py

@@ -340,7 +340,29 @@ class TestMove(unittest.TestCase):
         dst = os.path.join(self.src_dir, "bar")
         self.assertRaises(shutil.Error, shutil.move, self.src_dir, dst)
 
+    def test_destinsrc_false_negative(self):
+        os.mkdir(TESTFN)
+        try:
+            for src, dst in [('srcdir', 'srcdir/dest')]:
+                src = os.path.join(TESTFN, src)
+                dst = os.path.join(TESTFN, dst)
+                self.assert_(shutil.destinsrc(src, dst),
+                             msg='destinsrc() wrongly concluded that '
+                             'dst (%s) is not in src (%s)' % (dst, src))
+        finally:
+            shutil.rmtree(TESTFN, ignore_errors=True)
 
+    def test_destinsrc_false_positive(self):
+        os.mkdir(TESTFN)
+        try:
+            for src, dst in [('srcdir', 'src/dest'), ('srcdir', 'srcdir.new')]:
+                src = os.path.join(TESTFN, src)
+                dst = os.path.join(TESTFN, dst)
+                self.failIf(shutil.destinsrc(src, dst),
+                            msg='destinsrc() wrongly concluded that '
+                            'dst (%s) is in src (%s)' % (dst, src))
+        finally:
+            shutil.rmtree(TESTFN, ignore_errors=True)
 
 def test_main():
     test_support.run_unittest(TestShutil, TestMove)

Misc/NEWS

@@ -145,6 +145,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #2047: shutil.move() could believe that its destination path was
+  inside its source path if it began with the same letters (e.g. "src" vs.
+  "src.new").
+
 - Issue 4920:  Fixed .next() vs .__next__() issues in the ABCs for
   Iterator and MutableSet.