- Labels: bug, robustness
- Priority: P0
- Target version: v0.5.1
- Owner: eneskemalergin
Problem. pxaudit cache clear deletes every regular file directly inside the configured cache directory. cache info counts the same unrestricted set. The command has no ownership check and no guard against a configured filesystem root, home directory, or other shared location.
Impact. A configuration mistake or broad --cache-dir value can delete unrelated user data. --yes makes the destructive path non-interactive without making it safer.
Root cause. cache_clear() and _cache_stats() treat Path.iterdir() plus is_file() as sufficient proof that PXAudit owns an entry.
Approach. Define one cache-entry validator used by both commands. Validate the filename, endpoint, canonical accession, cache envelope, containment, and symlink policy. Refuse dangerous cache roots before confirmation and report ignored entries without deleting them.
Phase 7 coverage. Workstream 2 cache ownership, cache info parity, dangerous-path guards, mixed-directory tests, and real-user-cache isolation.
Problem.
pxaudit cache cleardeletes every regular file directly inside the configured cache directory.cache infocounts the same unrestricted set. The command has no ownership check and no guard against a configured filesystem root, home directory, or other shared location.Impact. A configuration mistake or broad
--cache-dirvalue can delete unrelated user data.--yesmakes the destructive path non-interactive without making it safer.Root cause.
cache_clear()and_cache_stats()treatPath.iterdir()plusis_file()as sufficient proof that PXAudit owns an entry.Approach. Define one cache-entry validator used by both commands. Validate the filename, endpoint, canonical accession, cache envelope, containment, and symlink policy. Refuse dangerous cache roots before confirmation and report ignored entries without deleting them.
Phase 7 coverage. Workstream 2 cache ownership,
cache infoparity, dangerous-path guards, mixed-directory tests, and real-user-cache isolation.