Sanitize file names with filepath.Base and use os.Remove

Snyk static analysis does not recognize BuildPathChecked as sufficient
sanitization for os.RemoveAll. Use filepath.Base to strip directory
components from file names and switch to os.Remove since bundles are
regular files, not directories.

Author: sebrandon1

cmd/crc/cmd/bundle/clear.go

@@ -2,11 +2,11 @@ package bundle
 
 import (
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/crc-org/crc/v2/pkg/crc/constants"
 	"github.com/crc-org/crc/v2/pkg/crc/logging"
-	"github.com/crc-org/crc/v2/pkg/extract"
 	"github.com/spf13/cobra"
 )
 
@@ -37,13 +37,10 @@ func runClear() error {
 	var lastErr error
 	for _, file := range files {
 		if strings.HasSuffix(file.Name(), ".crcbundle") {
-			filePath, err := extract.BuildPathChecked(cacheDir, file.Name())
-			if err != nil {
-				logging.Errorf("Skipping unsafe path %s: %v", file.Name(), err)
-				continue
-			}
+			safeName := filepath.Base(file.Name())
+			filePath := filepath.Join(cacheDir, safeName)
 			logging.Infof("Deleting %s", filePath)
-			if err := os.RemoveAll(filePath); err != nil {
+			if err := os.Remove(filePath); err != nil {
 				logging.Errorf("Failed to remove %s: %v", filePath, err)
 				lastErr = err
 			} else {

cmd/crc/cmd/bundle/prune.go

@@ -3,14 +3,14 @@ package bundle
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/crc-org/crc/v2/pkg/crc/constants"
 	"github.com/crc-org/crc/v2/pkg/crc/logging"
-	"github.com/crc-org/crc/v2/pkg/extract"
 	"github.com/spf13/cobra"
 )
 
@@ -110,13 +110,10 @@ func runPrune(keep int) error {
 		})
 
 		for i := keep; i < len(bundles); i++ {
-			filePath, err := extract.BuildPathChecked(cacheDir, bundles[i].name)
-			if err != nil {
-				logging.Errorf("Skipping unsafe path %s: %v", bundles[i].name, err)
-				continue
-			}
-			logging.Infof("Pruning old bundle: %s", bundles[i].name)
-			if err := os.RemoveAll(filePath); err != nil {
+			safeName := filepath.Base(bundles[i].name)
+			filePath := filepath.Join(cacheDir, safeName)
+			logging.Infof("Pruning old bundle: %s", safeName)
+			if err := os.Remove(filePath); err != nil {
 				logging.Errorf("Failed to remove %s: %v", filePath, err)
 			}
 			pruned = true