Improve security of autoswitching by checking file ownership
Diff
1diff --git a/autoswitch_virtualenv.plugin.zsh b/autoswitch_virtualenv.plugin.zsh
2index 52760adeccafb14b0b092cf363fbf3e80ef6b1b4..424e6d3881f132d6b59c07d6a70d089c90f69779 100644
3--- a/autoswitch_virtualenv.plugin.zsh
4+++ b/autoswitch_virtualenv.plugin.zsh
5@@ -17,14 +17,21 @@ function maybeworkon() {
6 fi
7 }
8 9+
10 # Automatically switch virtualenv when .venv file detected
11 function check_venv()
12 {
13 if [ "$PWD" != "$MYOLDPWD" ]; then
14 MYOLDPWD="$PWD"
15 if [[ -f ".venv" ]]; then
16- maybeworkon "$(cat .venv)"
17- AUTOSWITCH_PROJECT="$PWD"
18+ if [[ "$(stat -c %u .venv)" = "$(id -u)" ]]; then
19+ maybeworkon "$(cat .venv)"
20+ AUTOSWITCH_PROJECT="$PWD"
21+ else
22+ echo "AUTOSWITCH WARNING: Found a .venv file but it is not owned by the current user"
23+ echo "This will not be activated to prevent potentially malicious actions"
24+ echo "Change ownership of .venv to '$USER' to fix this"
25+ fi
26 elif [[ "$PWD" != "$AUTOSWITCH_PROJECT/"* ]]; then
27 default_venv
28 AUTOSWITCH_PROJECT=""