From ca5bcf37e40d4dbd41dc9d9d001d6f4b9c6dcd65 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 16 Jun 2026 23:11:32 +0300 Subject: 8n0 validate DIST_DIR before --clean rm -rf The --clean action ran `rm -rf "$DIST_DIR"` after only an `[ -d ]` check, so a misconfigured DIST_DIR (empty, /, $HOME, system dirs, etc.) could recursively delete the wrong tree. Add validate_clean_dist_dir (and resolve_dist_dir_path) in config.validate.source.sh and call it in the --clean case before any deletion. The guard canonicalizes DIST_DIR with `pwd -P` (handling ./ trailing slashes, symlinks and relative paths; for a not-yet-existing dir it resolves the existing parent and re-attaches the basename) and refuses to clean when the resolved path is empty, the filesystem root, a well-known system directory, the resolved $HOME, or the current working directory. Rejection uses config_error with a clear message and a non-zero exit, so nothing is deleted. Normal DIST_DIRs still clean. Tests (tests/cli.sh, registered in main): a HOME-as-DIST_DIR case (uses a fake HOME under TEST_TMPDIR with a sentinel file, so a regression can only touch the throwaway temp dir) and an empty-DIST_DIR case both assert rejection and that nothing is removed. Note: leftover staging artifacts on --clean are out of scope (task ln0). Co-Authored-By: Claude Opus 4.8 --- src/lib/action.source.sh | 10 +++++ src/lib/config.validate.source.sh | 84 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 94 insertions(+) (limited to 'src') diff --git a/src/lib/action.source.sh b/src/lib/action.source.sh index 12be053..edececa 100644 --- a/src/lib/action.source.sh +++ b/src/lib/action.source.sh @@ -188,6 +188,16 @@ run_configured_action() { case "$SHURIKEN_CLI_ACTION" in --clean) + # Validate DIST_DIR before any destructive rm -rf. Unlike the bare + # check that used to live here, validate_clean_dist_dir rejects unset, + # empty, and dangerous paths (/, HOME, cwd, system dirs) so a + # misconfigured DIST_DIR can never nuke the wrong tree. + validate_clean_dist_dir + status=$? + if (( status != 0 )); then + return "$status" + fi + if [ -d "$DIST_DIR" ]; then log_info "Cleaning $DIST_DIR" rm -rf "$DIST_DIR" diff --git a/src/lib/config.validate.source.sh b/src/lib/config.validate.source.sh index 7519094..28aeace 100644 --- a/src/lib/config.validate.source.sh +++ b/src/lib/config.validate.source.sh @@ -74,6 +74,90 @@ validate_dist_dir() { fi } +# Resolve DIST_DIR to a canonical absolute path so the --clean guard cannot be +# bypassed via "." / trailing slashes / symlinks / relative paths. The directory +# itself may not exist yet (cleaning a stale config), so when it is missing we +# resolve its existing parent and append the basename. Output is printed; the +# caller captures it. Returns non-zero only if even the parent cannot resolve. +resolve_dist_dir_path() { + local -r target_dir="$1"; shift + local parent base + + if [ -d "$target_dir" ]; then + ( cd "$target_dir" && pwd -P ) && return + return 1 + fi + + # DIST_DIR does not exist: canonicalize the deepest existing ancestor and + # re-attach the remaining path so symlinked parents are still resolved. + parent=$(existing_parent_dir "$target_dir") + base=${target_dir#"$parent"} + base=${base#/} + parent=$( cd "$parent" && pwd -P ) || return 1 + if [ -n "$base" ]; then + printf '%s/%s\n' "$parent" "$base" + else + printf '%s\n' "$parent" + fi +} + +# Guard for the destructive --clean action: refuse to "rm -rf" DIST_DIR when it +# resolves to an empty value or a clearly dangerous location (filesystem root, +# the user's HOME, the current working directory, or a well-known system tree). +# This is the single place where the dangerous-path policy lives so it stays in +# sync. NOTE (ln0): this only guards against deleting the wrong tree; leftover +# staging artifacts are a separate concern handled by task ln0. +validate_clean_dist_dir() { + local resolved home_resolved cwd_resolved + local -a forbidden=( + / /home /root /tmp /usr /etc /var /bin /sbin /lib /boot /opt + ) + local entry + + require_config_var DIST_DIR || return + + # Reuse the shared DIST_DIR sanity checks (must be a directory, writable, + # parent writable) before applying the destructive-path policy. + validate_dist_dir || return + + resolved=$(resolve_dist_dir_path "$DIST_DIR") || { + config_error "DIST_DIR $DIST_DIR could not be resolved" + return 1 + } + + if [ -z "$resolved" ]; then + config_error 'refusing to clean an empty DIST_DIR' + return 1 + fi + + # Reject the filesystem root and well-known system directories outright. + for entry in "${forbidden[@]}"; do + if [ "$resolved" = "$entry" ]; then + config_error \ + "refusing to clean DIST_DIR $resolved (dangerous path)" + return 1 + fi + done + + # Reject HOME and the current working directory themselves (deleting either + # would be catastrophic and is never the intended DIST_DIR). + if [ -n "${HOME:-}" ]; then + home_resolved=$( cd "$HOME" 2>/dev/null && pwd -P ) || home_resolved='' + if [ -n "$home_resolved" ] && [ "$resolved" = "$home_resolved" ]; then + config_error \ + "refusing to clean DIST_DIR $resolved (is HOME)" + return 1 + fi + fi + + cwd_resolved=$(pwd -P) + if [ "$resolved" = "$cwd_resolved" ]; then + config_error \ + "refusing to clean DIST_DIR $resolved (is current directory)" + return 1 + fi +} + validate_template_dir_access() { if [[ ! -d "$TEMPLATE_DIR" || ! -r "$TEMPLATE_DIR" \ || ! -x "$TEMPLATE_DIR" ]]; then -- cgit v1.2.3