Merge pull request #346 from PyAr/exec-only-from-venv

Verify that a path was not given to --exec. Fixes #331.

README.rst

@@ -228,7 +228,10 @@ script stderr is not polluted at all.
 
 Sometimes, you want to run a script provided by one of the dependencies
 installed into the virtualenv. *fades* supports this via the ``-x`` (
-or ``--exec`` argument).
+or ``--exec`` argument). The parameter given to this option needs to be just
+the executable name; it's an error to use this to execute anything outside
+the venv's bin directory, just don't use this option and pass the executable
+directly if you want that.
 
 If you want to use IPython shell you need to call *fades* with ``-i`` or
 ``--ipython`` option. This option will add IPython as a dependency to *fades*

fades/main.py

@@ -258,6 +258,13 @@ def go():
             logger.warning('No virtualenv found with uuid: %s.', uuid)
         return 0
 
+    # if --exec given, check that it's just the executable name, not absolute or relative paths
+    if args.executable and os.path.sep in args.child_program:
+        logger.error(
+            "The parameter to --exec must be a file name (to be found "
+            "inside venv's bin directory), not a file path: %r", args.child_program)
+        raise FadesError("File path given to --exec parameter")
+
     # decided which the child program really is
     analyzable_child_program, child_program = decide_child_program(
         args.executable, args.child_program)

man/fades.1

@@ -82,7 +82,9 @@ The dependencies can be indicated in multiple places (in the Python source file,
 
 .TP
 .BR -x ", " --exec
-Execute the \fIchild_program\fR inside the virtualenv.
+Execute the \fIchild_program\fR inside the virtualenv (so the parameter given needs to be just 
+the executable name). It's an error to use this option to execute anything outside the venv's bin 
+directory, just stop using this option for that case.
 
 The \fIchild_program\fR \fBmust\fR be found in the virtualenv's \fIbin\fR directory.