security: remediate review B findings

internal/storage/storage.go

@@ -150,7 +150,49 @@ func (s Local) Trash(path string) error {
 	if e != nil {
 		return e
 	}
-	return wastebasket.Trash(p)
+	if err := wastebasket.Trash(p); err != nil {
+		return err
+	}
+	_ = cleanupSystemTrash(30 * 24 * time.Hour)
+	return nil
+}
+
+func cleanupSystemTrash(maxAge time.Duration) error {
+	base := os.Getenv("XDG_DATA_HOME")
+	if base == "" {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return err
+		}
+		base = filepath.Join(home, ".local", "share")
+	}
+	root := filepath.Join(base, "Trash")
+	filesDir := filepath.Join(root, "files")
+	infoDir := filepath.Join(root, "info")
+	now := time.Now()
+	entries, err := os.ReadDir(infoDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".trashinfo" {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			continue
+		}
+		if now.Sub(info.ModTime()) <= maxAge {
+			continue
+		}
+		name := strings.TrimSuffix(entry.Name(), ".trashinfo")
+		_ = os.Remove(filepath.Join(infoDir, entry.Name()))
+		_ = os.RemoveAll(filepath.Join(filesDir, name))
+	}
+	return nil
 }
 
 func (s Local) MoveToTrash(path, trashRoot string) error {

internal/storage/trash_cleanup_test.go

@@ -0,0 +1,42 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestCleanupSystemTrashRemovesOldEntries(t *testing.T) {
+	data := t.TempDir()
+	t.Setenv("XDG_DATA_HOME", data)
+	files := filepath.Join(data, "Trash", "files")
+	info := filepath.Join(data, "Trash", "info")
+	if err := os.MkdirAll(files, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(info, 0755); err != nil {
+		t.Fatal(err)
+	}
+	oldInfo := filepath.Join(info, "old.txt.trashinfo")
+	oldFile := filepath.Join(files, "old.txt")
+	if err := os.WriteFile(oldInfo, []byte("[Trash Info]\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(oldFile, []byte("old"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	old := time.Now().Add(-31 * 24 * time.Hour)
+	if err := os.Chtimes(oldInfo, old, old); err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanupSystemTrash(30 * 24 * time.Hour); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(oldInfo); !os.IsNotExist(err) {
+		t.Fatalf("old info remains: %v", err)
+	}
+	if _, err := os.Stat(oldFile); !os.IsNotExist(err) {
+		t.Fatalf("old file remains: %v", err)
+	}
+}