Advisories for Cargo/Uu_rm package

rm -rf . is correctly refused, but clean_trailing_slashes normalizes ./// to ./ while path_is_current_or_parent_directory only matches ./.. (and /.//..), not ./ or ../. So rm -rf ./ recursively deletes the directory's contents and then prints a misleading cannot remove './': Invalid input. Impact: all files/subdirectories in the current directory are silently deleted; the misleading error makes users miss the recovery window. Recommendation: handle trailing-slash variants in path_is_current_or_parent_directory. Remediation: Acknowledged by …

The –preserve-root check uses a path-string test (path.has_root() && path.parent().is_none()) rather than comparing device/inode. A symlink to / (e.g. /tmp/rootlink -> /) has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it. Impact: rm -rf –preserve-root on a path that resolves through a symlink to / bypasses protection and can delete system directories. Recommendation: compare each entered directory's …