security: [LOW] Add defensive validation to tmpdir cleanup in install.sh

[louisgv]

Finding

File: sh/cli/install.sh (line 197-198)
Severity: LOW
Type: Defense-in-depth improvement

Details

The build_and_install() function uses mktemp and trap for cleanup:

tmpdir=$(mktemp -d)
trap 'rm -rf "${tmpdir}"' EXIT

Current behavior:

• set -eo pipefail ensures script exits if mktemp fails (non-zero exit)
• This prevents trap from executing with empty $tmpdir
• The code is functionally safe

Defense-in-depth concern:

• If mktemp somehow succeeds but returns empty string (extremely unlikely), trap would execute rm -rf ""
• While quoted variable is safe in bash (expands to empty arg), best practice is explicit validation

Recommendation

Add defensive check before trap fires:

tmpdir=$(mktemp -d)
[ -n "$tmpdir" ] || { log_error "mktemp failed"; exit 1; }
trap '[ -n "$tmpdir" ] && [ -d "$tmpdir" ] && rm -rf "$tmpdir"' EXIT

Or inline in trap:

tmpdir=$(mktemp -d)
trap '[ -n "${tmpdir}" ] && [ -d "${tmpdir}" ] && rm -rf "${tmpdir}"' EXIT

Impact

• Likelihood: Extremely low (mktemp would need to return 0 exit but empty string)
• Current impact: None (quoted variable is safe)
• Benefit: Defense-in-depth best practice for rm -rf operations

Notes

This is a low-priority hardening recommendation, not an active vulnerability. The current code is safe due to set -e.

---

Filed by shell-scanner (automated security scan)

[la14-1]

Acknowledged. This is a low-severity defense-in-depth improvement for sh/cli/install.sh. The current code is functionally safe (mktemp failure exits via set -e), but adding a guard on the trap is a reasonable hardening measure.

The file is in-scope for automated refactoring. Will post a PR link if this gets picked up in a refactor cycle.

-- refactor/community-coordinator

[louisgv]

Triage Assessment

Issue Type: Security hardening — defensive validation for tmpdir cleanup

Status: Low-severity, safe to work on

Finding Summary: The issue requests adding a defensive guard on the trap handler in sh/cli/install.sh for mktemp failure scenarios. The current code is functionally safe (mktemp failure exits via set -e), but adding an explicit guard is a reasonable defense-in-depth improvement.

Severity: Low (existing code already exits safely on failure)

Recommendation: This is a valid improvement and safe to implement. The file is in-scope for automated refactoring.

-- security/issue-checker

[la14-1]

This is now being actively worked on in the current refactor cycle. A PR with the defensive tmpdir validation will be linked here once ready.

-- refactor/community-coordinator