prevent removal of a user's home directory (#6)

Fixes: npm/npm#14012

PR-URL: #6
Credit: @helio-frota
Reviewed-By: @zkat

README.md

@@ -18,7 +18,7 @@ var options = {
 /* Assuming there are no other files or directories in "out", "to", or "my",
  * the final path will just be "/path/to/my/tree/root".
  */
-vacuum("/path/to/my/tree/root/out/to/my/files", function (error) {
+vacuum("/path/to/my/tree/root/out/to/my/files", options, function (error) {
   if (error) console.error("Unable to cleanly vacuum:", error.message);
 });
 ```

test/not-remove-home-directory.js

@@ -0,0 +1,46 @@
+var path = require('path')
+
+var test = require('tap').test
+var mkdtemp = require('tmp').dir
+var mkdirp = require('mkdirp')
+
+var vacuum = require('../vacuum.js')
+
+// CONSTANTS
+var TEMP_OPTIONS = {
+  unsafeCleanup: true,
+  mode: '0700'
+}
+
+var BASE_PATH = path.join('foo')
+var HOME_PATH = path.join(BASE_PATH, 'foo', 'bar')
+
+var messages = []
+function log () { messages.push(Array.prototype.slice.call(arguments).join(' ')) }
+
+var homePath, basePath, realHome
+test('xXx setup xXx', function (t) {
+  mkdtemp(TEMP_OPTIONS, function (er, tmpdir) {
+    t.ifError(er, 'temp directory exists')
+
+    homePath = path.resolve(tmpdir, HOME_PATH)
+    basePath = path.resolve(tmpdir, BASE_PATH)
+
+    realHome = process.env.HOME
+    process.env.HOME = homePath
+
+    mkdirp(homePath, function (er) {
+      t.ifError(er, 'made test path')
+      t.end()
+    })
+  })
+})
+
+test('do not remove home directory', function (t) {
+  vacuum(homePath, {purge: false, base: basePath, log: log}, function (er) {
+    t.ifError(er, 'cleaned up to base')
+    t.equal(messages[0], 'quitting because cannot remove home directory ' + homePath)
+    process.env.HOME = realHome
+    t.end()
+  })
+})

vacuum.js

@@ -79,6 +79,11 @@ function vacuum (leaf, options, cb) {
         return cb(null)
       }
 
+      if (branch === process.env.HOME) {
+        log('quitting because cannot remove home directory', branch)
+        return cb(null)
+      }
+
       log('removing', branch)
       lstat(branch, function (error, stat) {
         if (error) {