Problem
install.sh --uninstall --purge-cache derives a cache directory from XDG_CACHE_HOME or HOME and recursively removes it without an explicit safe-root check.
Evidence
install.sh uses:
local cache_dir="${XDG_CACHE_HOME:-${HOME}/.cache}/cdidx"
rm -rf "$cache_dir"Expected behavior
Normalize the cache path and assert it is under an expected user cache root before recursive deletion. Failure to validate should abort with a clear diagnostic.
Labels
bug, security
Problem
install.sh --uninstall --purge-cachederives a cache directory fromXDG_CACHE_HOMEorHOMEand recursively removes it without an explicit safe-root check.Evidence
install.shuses:Expected behavior
Normalize the cache path and assert it is under an expected user cache root before recursive deletion. Failure to validate should abort with a clear diagnostic.
Labels
bug,security