fix(dev-env): CWE-377, CWE-378 originating from xdgDataDirectory()

[sjinks]

Description

This PR fixes CWE-377 and CWE-378, which come from xdgDataDirectory().

The code used to fall back to the system temporary directory if the XDG Data Directory is unavailable. However, that solution was not really good because files in the temporary directory can be deleted by the system without a prior warning.

The code that finds out the XDG Data Directory is this:

const homeDirectory = os.homedir();
const {env} = process;

exports.data = env.XDG_DATA_HOME ||
        (homeDirectory ? path.join(homeDirectory, '.local', 'share') : undefined);

The only way to get undefined is not to have the XDG_DATA_HOME environment variable set and not to have the home directory. This is a very extreme case :-)

The current solution is to throw an exception if we cannot determine the data directory.

The other (and not fixed) issue is that xdg-basedir package is the wrong tool to use:

This package is meant for Linux. You should not use XDG on macOS or Windows. Instead, you should follow their platform conventions. You can use env-paths for that.

However, I am not in the mood to fix this now. Maybe someday :-)

Fixes: #1653

Refs:

• https://github.com/Automattic/vip-cli/security/code-scanning/13
• https://github.com/Automattic/vip-cli/security/code-scanning/14
• https://github.com/Automattic/vip-cli/security/code-scanning/15
• https://github.com/Automattic/vip-cli/security/code-scanning/16
• https://github.com/Automattic/vip-cli/security/code-scanning/17
• https://github.com/Automattic/vip-cli/security/code-scanning/18
• https://github.com/Automattic/vip-cli/security/code-scanning/19

Pull request checklist

• Update SETUP.md with any new environmental variables.
• Update the documentation.
• Manually test the relevant changes.
• Follow the pull request checklist
• Add/update automated tests as needed.

New release checklist

• Automated tests pass.
• The Preparing for release checklist is completed.

Steps to Test

CI should pass.

[sonarqubecloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud