nvidia-holoscan / holoscan-cli / 28717148185

77%

main: 77%

Build Type

Pull #198

github

Committed by wyli

Commit Message

fix: add destructive-boundary guard to clear-cache

`clear-cache` fed shutil.rmtree() with directories derived from
env-overridable roots (HOLOSCAN_CLI_BUILD_PARENT_DIR / _DATA_DIR) and
repo-root globs, with no safety boundary. A hostile or fat-fingered
value such as `HOLOSCAN_CLI_BUILD_PARENT_DIR=/` made the command report
`Would remove: /` and, without --dryrun under root, would wipe the
filesystem.

Add `_is_safe_to_remove()`: canonicalize each candidate and refuse it
unless it is (1) not a critical anchor (`/`, $HOME, the repo root) or an
ancestor of one, and (2) at or under an approved cache root (the repo
tree, the build parent dir, or the data dir). Refused paths print a
`Refusing to remove:` notice and are skipped.

Also fix the policy regression where `test --clear-cache` forwarded the
test namespace directly: with build/data/install unset, clear-cache
treated it as "clear everything" including downloaded data. Select
build/install explicitly, matching historical HoloHub behavior.

Add destructive-boundary tests covering /, $HOME, the repo root, an
ancestor of the repo root, the happy path, and data preservation on
`test --clear-cache`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Pull Request Pull Request #198: fix: destructive-boundary guard for clear-cache

Coverage Stats

175 of 200 new or added lines in 9 files covered. (87.5%)

1 existing line in 1 file now uncovered.

3149 of 3969 relevant lines covered (79.34%)

0.79 hits per line