From aa53b50f2af39ceeaa64fb238ae4d19d2a73ab6f Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 11 Nov 2026 00:00:06 +0000
Subject: [PATCH] address review: refuse the shared temp folder itself as a
 disk cache folder

---
 crates/render/src/disk_cache.rs | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/crates/render/src/disk_cache.rs b/crates/render/src/disk_cache.rs
index c27009ea9..ac5edc3be 100644
--- a/crates/render/src/disk_cache.rs
+++ b/crates/render/src/disk_cache.rs
@@ -316,7 +316,11 @@ fn make_private(folder: &Path) -> std::io::Result<()> {
     let tmp_real = tmp.canonicalize().unwrap_or_else(|_| tmp.clone());
     let given = std::path::absolute(folder).unwrap_or_else(|_| folder.to_path_buf());
     let real = folder.canonicalize().unwrap_or_else(|_| given.clone());
-    // The shared folder itself is not ours to change: only folders inside it.
+    // The shared folder itself is not ours to change or to keep a cache in: refused.
+    if [&given, &real].iter().any(|p| **p == tmp || **p == tmp_real) {
+        return Err(std::io::Error::new(std::io::ErrorKind::PermissionDenied, "the disk cache folder is the shared temp folder"));
+    }
+    // Only folders inside it are made private.
     let inside = |p: &PathBuf, t: &PathBuf| p.starts_with(t) && p != t;
     if ![&given, &real].iter().any(|p| inside(p, &tmp) || inside(p, &tmp_real)) {
         return Ok(());
@@ -1051,6 +1055,13 @@ mod tests {
         let _ = std::fs::remove_dir_all(&d);
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn the_shared_temp_folder_itself_is_refused_as_a_cache_folder() {
+        let tmp = std::env::temp_dir();
+        assert!(DiskCache::open(&tmp, 1 << 20).is_err());
+    }
+
     #[cfg(unix)]
     #[test]
     fn a_folder_that_resolves_into_the_temp_folder_is_made_private() {