From ca5bcf37e40d4dbd41dc9d9d001d6f4b9c6dcd65 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 16 Jun 2026 23:11:32 +0300 Subject: 8n0 validate DIST_DIR before --clean rm -rf The --clean action ran `rm -rf "$DIST_DIR"` after only an `[ -d ]` check, so a misconfigured DIST_DIR (empty, /, $HOME, system dirs, etc.) could recursively delete the wrong tree. Add validate_clean_dist_dir (and resolve_dist_dir_path) in config.validate.source.sh and call it in the --clean case before any deletion. The guard canonicalizes DIST_DIR with `pwd -P` (handling ./ trailing slashes, symlinks and relative paths; for a not-yet-existing dir it resolves the existing parent and re-attaches the basename) and refuses to clean when the resolved path is empty, the filesystem root, a well-known system directory, the resolved $HOME, or the current working directory. Rejection uses config_error with a clear message and a non-zero exit, so nothing is deleted. Normal DIST_DIRs still clean. Tests (tests/cli.sh, registered in main): a HOME-as-DIST_DIR case (uses a fake HOME under TEST_TMPDIR with a sentinel file, so a regression can only touch the throwaway temp dir) and an empty-DIST_DIR case both assert rejection and that nothing is removed. Note: leftover staging artifacts on --clean are out of scope (task ln0). Co-Authored-By: Claude Opus 4.8 --- src/lib/action.source.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'src/lib/action.source.sh') diff --git a/src/lib/action.source.sh b/src/lib/action.source.sh index 12be053..edececa 100644 --- a/src/lib/action.source.sh +++ b/src/lib/action.source.sh @@ -188,6 +188,16 @@ run_configured_action() { case "$SHURIKEN_CLI_ACTION" in --clean) + # Validate DIST_DIR before any destructive rm -rf. Unlike the bare + # check that used to live here, validate_clean_dist_dir rejects unset, + # empty, and dangerous paths (/, HOME, cwd, system dirs) so a + # misconfigured DIST_DIR can never nuke the wrong tree. + validate_clean_dist_dir + status=$? + if (( status != 0 )); then + return "$status" + fi + if [ -d "$DIST_DIR" ]; then log_info "Cleaning $DIST_DIR" rm -rf "$DIST_DIR" -- cgit v1.2.3