Verify if script name provided is a file before running it (#1155)

Co-authored-by: Tzu-ping Chung <[email protected]>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -5,6 +5,7 @@
 - Update `pipx run` on scripts using `/// script` and no `run` table following the updated version of PEP 723 (#1180)
 - Avoid repeated exception logging in a few rare cases (#1192)
 - Include `tomli` into `pipx.pyz` (zipapp) so that it can be executed with Python 3.10 or earlier (#1142)
+- `pipx run`: Verify whether the script name provided is a file before running it
 
 ## 1.4.1
 

src/pipx/commands/run.py

@@ -48,7 +48,7 @@ def maybe_script_content(app: str, is_path: bool) -> Optional[str]:
 
     # Look for a local file first.
     app_path = Path(app)
-    if app_path.exists():
+    if app_path.is_file():
         return app_path.read_text(encoding="utf-8")
     elif is_path:
         raise PipxError(f"The specified path {app} does not exist")

tests/test_run.py

@@ -355,6 +355,14 @@ def test_run_with_windows_python_version(caplog, pipx_temp_env, tmp_path):
     assert "3.12" in out.read_text()
 
 
+@mock.patch("os.execvpe", new=execvpe_mock)
+def test_run_verify_script_name_provided(pipx_temp_env, capsys, tmpdir):
+    tmpdir.mkdir("black")
+    run_pipx_cli_exit(["run", "black"])
+    captured = capsys.readouterr()
+    assert "black" in captured.err
+
+
 @mock.patch("os.execvpe", new=execvpe_mock)
 def test_run_shared_lib_as_app(pipx_temp_env, monkeypatch, capfd):
     run_pipx_cli_exit(["run", "pip", "--help"])