Ensure the config files have the right permissions

poetry/config.py

+from __future__ import absolute_import
+
+import io
+import os
+
 from typing import Any
 
 from tomlkit import document
@@ -76,7 +81,26 @@ class Config:
         self.dump()
 
     def dump(self):
-        self._file.write(self._content)
+        # Ensuring the file is only readable and writable
+        # by the current user
+        mode = 0o600
+        umask = 0o777 ^ mode
+
+        if self._file.exists():
+            # If the file already exists, remove it
+            # if the permissions are higher than what we want
+            current_mode = os.stat(str(self._file)).st_mode & 0o777
+            if current_mode != 384:
+                os.remove(str(self._file))
+
+        umask_original = os.umask(umask)
+        try:
+            fd = os.open(str(self._file), os.O_WRONLY | os.O_CREAT, mode)
+        finally:
+            os.umask(umask_original)
+
+        with io.open(fd, "w", encoding="utf-8") as f:
+            f.write(self._content.as_string())
 
     @classmethod
     def create(cls, file, base_dir=None):  # type: (...) -> Config

poetry/utils/toml_file.py

@@ -17,3 +17,6 @@ class TomlFile(BaseTOMLFile):
 
     def __getattr__(self, item):
         return getattr(self._path_, item)
+
+    def __str__(self):
+        return str(self._path)

tests/console/commands/test_config.py

@@ -4,7 +4,6 @@ import tempfile
 from cleo.testers import CommandTester
 
 from poetry.config import Config
-from poetry.utils._compat import Path
 from poetry.utils.toml_file import TomlFile
 
 

tests/test_config.py

+import os
+import pytest
+import tempfile
+
+from poetry.config import Config
+from poetry.utils.toml_file import TomlFile
+
+
+@pytest.fixture
+def config():
+    with tempfile.NamedTemporaryFile() as f:
+        f.close()
+
+        return Config(TomlFile(f.name))
+
+
+def test_config_sets_the_proper_file_permissions(config):
+    config.add_property("settings.virtualenvs.create", True)
+
+    mode = oct(os.stat(str(config.file)).st_mode & 0o777)
+
+    assert int(mode, 8) == 384