From 8bea200b98356c931aed6ae3ddfe2e1f5400ab71 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Wed, 23 Jan 2013 10:44:21 +0200
Subject: [PATCH] Issue #16957: shutil.which() no longer searches a bare file
 name in the current directory on Unix and no longer searches a relative file
 path with a directory part in PATH directories.  Patch by Thomas Kluyver.

---
 Lib/shutil.py           | 11 +++++++----
 Lib/test/test_shutil.py | 37 +++++++++++++++++++++++++++++--------
 Misc/NEWS               |  4 ++++
 3 files changed, 40 insertions(+), 12 deletions(-)

diff --git a/Lib/shutil.py b/Lib/shutil.py
index 86c32fa20ad..e4b640cd17f 100644
--- a/Lib/shutil.py
+++ b/Lib/shutil.py
@@ -1077,10 +1077,13 @@ def which(cmd, mode=os.F_OK | os.X_OK, path=None):
         return (os.path.exists(fn) and os.access(fn, mode)
                 and not os.path.isdir(fn))
 
-    # Short circuit. If we're given a full path which matches the mode
-    # and it exists, we're done here.
-    if _access_check(cmd, mode):
-        return cmd
+    # If we're given a path with a directory part, look it up directly rather
+    # than referring to PATH directories. This includes checking relative to the
+    # current directory, e.g. ./script
+    if os.path.dirname(cmd):
+        if _access_check(cmd, mode):
+            return cmd
+        return None
 
     path = (path or os.environ.get("PATH", os.defpath)).split(os.pathsep)
 
diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
index bfd0fb5906b..f6e5a9c41d4 100644
--- a/Lib/test/test_shutil.py
+++ b/Lib/test/test_shutil.py
@@ -1285,11 +1285,36 @@ class TestWhich(unittest.TestCase):
         rv = shutil.which(self.file, path=self.dir)
         self.assertEqual(rv, self.temp_file.name)
 
-    def test_full_path_short_circuit(self):
+    def test_absolute_cmd(self):
         # When given the fully qualified path to an executable that exists,
         # it should be returned.
         rv = shutil.which(self.temp_file.name, path=self.temp_dir)
-        self.assertEqual(self.temp_file.name, rv)
+        self.assertEqual(rv, self.temp_file.name)
+
+    def test_relative_cmd(self):
+        # When given the relative path with a directory part to an executable
+        # that exists, it should be returned.
+        base_dir, tail_dir = os.path.split(self.dir)
+        relpath = os.path.join(tail_dir, self.file)
+        with support.temp_cwd(path=base_dir):
+            rv = shutil.which(relpath, path=self.temp_dir)
+            self.assertEqual(rv, relpath)
+        # But it shouldn't be searched in PATH directories (issue #16957).
+        with support.temp_cwd(path=self.dir):
+            rv = shutil.which(relpath, path=base_dir)
+            self.assertIsNone(rv)
+
+    def test_cwd(self):
+        # Issue #16957
+        base_dir = os.path.dirname(self.dir)
+        with support.temp_cwd(path=self.dir):
+            rv = shutil.which(self.file, path=base_dir)
+            if sys.platform == "win32":
+                # Windows: current directory implicitly on PATH
+                self.assertEqual(rv, os.path.join(os.curdir, self.file))
+            else:
+                # Other platforms: shouldn't match in the current directory.
+                self.assertIsNone(rv)
 
     def test_non_matching_mode(self):
         # Set the file read-only and ask for writeable files.
@@ -1297,15 +1322,11 @@ class TestWhich(unittest.TestCase):
         rv = shutil.which(self.file, path=self.dir, mode=os.W_OK)
         self.assertIsNone(rv)
 
-    def test_relative(self):
-        old_cwd = os.getcwd()
+    def test_relative_path(self):
         base_dir, tail_dir = os.path.split(self.dir)
-        os.chdir(base_dir)
-        try:
+        with support.temp_cwd(path=base_dir):
             rv = shutil.which(self.file, path=tail_dir)
             self.assertEqual(rv, os.path.join(tail_dir, self.file))
-        finally:
-            os.chdir(old_cwd)
 
     def test_nonexistent_file(self):
         # Return None when no matching executable file is found on the path.
diff --git a/Misc/NEWS b/Misc/NEWS
index 6218c120c9d..5fdf5d1d5e1 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -150,6 +150,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #16957: shutil.which() no longer searches a bare file name in the
+  current directory on Unix and no longer searches a relative file path with
+  a directory part in PATH directories.  Patch by Thomas Kluyver.
+
 - Issue #1159051: GzipFile now raises EOFError when reading a corrupted file
   with truncated header or footer.