Found while dogfooding the current source with the locally built cdidx.
Active workspace state loading accepts or invents critical paths too leniently. A missing root falls back to the caller's current directory, db_path is accepted after GetFullPath without checking relationship to the root, missing db_path returns null without a diagnostic, and XDG_CONFIG_HOME is used directly when composing the active state path.
Evidence:
src/CodeIndex/ActiveWorkspace.cs Load uses ReadString(root, "root") ?? Environment.CurrentDirectory.- The same loader returns a state from
Path.GetFullPath(workspaceRoot) and Path.GetFullPath(dbPath) without a containment check.
- Missing
db_path returns null.
StatePath trusts raw XDG_CONFIG_HOME before appending cdidx/active.json.
Suggested fix: require explicit valid state roots, validate db_path ownership/containment or document allowed external DBs, surface safe diagnostics for malformed state, and validate config-home inputs before composing paths.
Found while dogfooding the current source with the locally built
cdidx.Active workspace state loading accepts or invents critical paths too leniently. A missing root falls back to the caller's current directory,
db_pathis accepted afterGetFullPathwithout checking relationship to the root, missingdb_pathreturns null without a diagnostic, andXDG_CONFIG_HOMEis used directly when composing the active state path.Evidence:
src/CodeIndex/ActiveWorkspace.csLoadusesReadString(root, "root") ?? Environment.CurrentDirectory.Path.GetFullPath(workspaceRoot)andPath.GetFullPath(dbPath)without a containment check.db_pathreturns null.StatePathtrusts rawXDG_CONFIG_HOMEbefore appendingcdidx/active.json.Suggested fix: require explicit valid state roots, validate
db_pathownership/containment or document allowed external DBs, surface safe diagnostics for malformed state, and validate config-home inputs before composing paths.