[Security] On Unix, the tools directory falls back to the shared temporary directory when HOME is not set #336

Summary

On Linux and macOS, PostSharp extracts its compiler tools into a per-user data directory and loads them from there. When neither XDG_DATA_HOME nor HOME is set, this directory falls back to <temporary directory>/postsharp, where the temporary directory is $TMPDIR or /tmp. This location is shared with all local users, so it is not a per-user directory.

This is a remaining case of #45, which moved the default directories to per-user locations.

Details

Core/PostSharp.MSBuild/PostSharp.properties selects _PostSharpPerUserDataDirectory on Unix in this order:

1. $XDG_DATA_HOME/postsharp
2. $HOME/.local/share/postsharp
3. Path.GetTempPath() followed by postsharp

The value is the default of PostSharpDefaultBinaryDirectory. BuildToolsHelper.Extract uses an existing tools directory when it contains PostSharp.Compiler.Engine.dll, and does not verify the integrity of the content. This is by design for a per-user directory, where the operating system enforces owner-only write access. The design does not hold for the third case.

Impact

The condition is narrow: the build must run without HOME and without XDG_DATA_HOME, for example in a process started with an empty environment, on a machine that has another local user who is not trusted. In that case, the other user can create the directory before the build does, and the build loads the compiler tools from it.

Builds that run with HOME set, which is the normal case, are not affected.

Proposed change

Remove the fallback to the temporary directory on Unix. When no per-user directory can be determined, fail the build with an error that asks the user to set HOME, XDG_DATA_HOME, or the PostSharp*Directory properties explicitly.

A user-specific subdirectory of the temporary directory is not sufficient, because its name is predictable and another user can create it first.

Breaking change

A build that runs on Unix without HOME and without XDG_DATA_HOME succeeds today and fails after this change. For this reason, the change is planned for 2027.0 and not for the maintenance releases.

-- Claude for Gael Fraiteur