bug: flet clean deletes unrelated build directories without validating the project
Duplicate Check
- I searched existing issues for
flet cleanand found no duplicate report of this behavior.
Describe the bug
flet clean <path> accepts any existing directory and recursively deletes its build/ child without checking whether the directory is a Flet project or whether the build output was generated by Flet. There is no confirmation or explicit override required for unrecognized directories.
A mistyped path in a script or automation can therefore delete an unrelated project's build output. Running flet clean from the wrong working directory has the same risk because the path defaults to ..
Code sample
This reproduction confines all files to a newly created temporary directory:
import subprocess
import tempfile
from pathlib import Path
with tempfile.TemporaryDirectory(prefix="flet-clean-repro-") as tmp:
unrelated_project = Path(tmp) / "unrelated-project"
build_dir = unrelated_project / "build"
build_dir.mkdir(parents=True)
artifact = build_dir / "unrelated-artifact.txt"
artifact.write_text("This output was not generated by Flet.\n")
subprocess.run(["flet", "clean", str(unrelated_project)], check=True)
print(f"Unrelated artifact still exists: {artifact.exists()}")To reproduce
- Use a Flet CLI version containing the current
cleancommand. - Run the sample above. The target has no Flet application, project configuration, or Flet-generated artifacts.
- The handler deletes the entire
build/directory; the sample should printUnrelated artifact still exists: False.
This report is based on source inspection and the existing test cases; the sample above has not been executed as part of filing this report.
Expected behavior
Cleaning an unrecognized directory should preserve its build output unless the caller explicitly opts into deleting it. A mistaken path should not silently remove an unrelated project's files.
Flet version
Source checkout at commit 59f759c4687c7188c1a813bcda139794ef3ae310. Released-version scope has not been verified.
Operating System
Inspected on macOS. The affected code has no platform-specific guard.
Regression
Unknown.
Suggestions
Consider checking a Flet-generated build marker or another reliable project identifier before deletion, with an explicit --force override for unrecognized directories. Account for Flet apps that do not have project metadata, and ensure non-interactive automation does not silently bypass the guard.
Additional details
- Path handling and deletion: the only target validation is
app_path.is_dir(), followed by a check thatbuildexists andshutil.rmtree(build_dir). - Existing test:
test_clean_respects_path_argumentexpects deletion in a directory with no Flet project files. - The command was requested in #6233.
Source: flet-dev/flet