Keep the cache fallback in the temporary directory out of other users' reach

[o-nnerb]

What

When the disk cache has no per-user directory to go to, it no longer uses a directory in the shared temporary directory that another user could have made first. (Audit E12, the /tmp fallback.)

The cache lives in Library/Caches on Darwin and in $XDG_CACHE_HOME or $HOME/.cache on Linux. Only a process with neither (no HOME, no XDG_CACHE_HOME: a launch daemon, some CI runners and containers) fell back to the temporary directory, to <tmp>/com.request-dl-nio.Swift.Cache: a path every user can predict, in a directory every user can write to. A user who got there first could create that directory, which made it theirs, and then rename it from under the process whenever they liked (shown with two uids on Linux). The entries are encrypted and authenticated (EncryptionKey), so what that could do was cost the victim its cache and read the names of the directories, which encode the URLs; this closes the door instead of relying on the key.

The change

The fallback is now Internals' FilePath.sharedCachesDirectory, resolved once per process:

1. <tmp>/request-dl-nio-<euid>, if FilePath.ownedDirectory(named:under:owner:) trusts it. It creates the directory owner only when it is not there, and trusts it when
   • it is a real directory (lstat, so a symbolic link someone planted is not followed), owned by the process's user, that group and others cannot even read; and
   • nobody but that user or root can rename it away: the parent is owned by one of them, and is not writable by group or others, or has the sticky bit (which is what the temporary directory of an ordinary machine has).
2. <tmp>/request-dl-nio-<random 64 bits>, created owner only with mkdir (which fails if the name exists), if the first is not trusted. It lasts as long as the process does: nobody else could have made it first, and the cache does not survive a restart in this case.
3. The temporary directory itself, where there is no lstat to ask (Windows), as it always was.

A directory that fails the check is left alone, not repaired or removed: it is someone else's.

What changes for whom

• Darwin, and Linux with HOME or XDG_CACHE_HOME: nothing.
• Linux without either: the cache moves from <tmp>/com.request-dl-nio.Swift.Cache/<suite> to <tmp>/request-dl-nio-<euid>/com.request-dl-nio.Swift.Cache/<suite>. The entries under the old path are not read again and nothing removes them (the same thing that happened when the cache moved out of /tmp for everyone else; that part of E12 is still open).
• Android (POSIX, but not os(Linux), so no XDG directory is looked for): the same as Linux without HOME. The temporary directory of an app is its own, so the check passes and the only difference is the request-dl-nio-<euid> level.
• Windows: nothing (no lstat to ask; the temporary directory is per user there).

Tests

InternalsCacheDirectoryTests, with who owns what as a parameter (two users cannot be had in a test):

• created owner only when absent; used when it is the owner's already;
• not used when it belongs to someone else, when group or others can get into it (0755, 0750, 0770, 0707), or when a symbolic link is there;
• not used when the parent lets others rename it (0777, no sticky bit); used when it is world-writable and sticky (1777); not used when the parent is missing;
• the exclusive directory is new every time and owner only, and nil without a parent;
• the shared fallback is not the temporary directory, is owner only and is the same every time.

Checked by weakening each check (the sticky/permission rule on the parent, the owner-only rule, and lstat for stat): the tests for the parent, for the mode and for the symbolic link fail.

macOS passes locally; Linux, Android and the static SDK (musl) are for CI: the code is POSIX and uses Darwin, Glibc, Musl or Android for mkdir, lstat and geteuid.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.64%. Comparing base (6fcd41d) to head (e884564).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #431      +/-   ##
==========================================
+ Coverage   94.63%   94.64%   +0.01%     
==========================================
  Files         464      465       +1     
  Lines       19367    19423      +56     
==========================================
+ Hits        18327    18382      +55     
- Misses       1040     1041       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.