VS Code for Linux may be secretly hoarding trashed files • The Register
#Vulnerabilities

VS Code for Linux may be secretly hoarding trashed files • The Register

Privacy Reporter
3 min read

Linux users who installed Microsoft's Visual Studio Code as a Snap package may want to check to see whether files they sent to the trash with the app have actually been deleted.

Linux users who installed Microsoft's Visual Studio Code as a Snap package may want to check to see whether files they sent to the trash with the app have actually been deleted. A handful of Linux-based developers have found large amounts of supposedly deleted data on their computers, in some cases consuming hundreds of gigabytes of storage.

Featured image

The reason for this is Snap – a Linux application packaging format – creates a local Trash folder for each VS Code version, one that's separate from the system-managed Trash, according to a VS Code bug report dating back to November 11, 2024. Not only that, but Snap keeps older versions of VS Code after updates, potentially multiplying the number of local Trash folders and the trashed-but-not-deleted files therein. Emptying the system Trash folder doesn't affect the local instances.

Neither VS Code nor Snap offers a way to manage these local trash folders, though this can be achieved with the command line. The root cause of the mess, according to a Microsoft engineer, is an unfixed VSCode change from October 11, 2024, that sets the XDG_DATA_HOME environment variable equal to $SNAP_USER_DATA/.local/share. "This creates a bogus Trash that's not the system one, and as such is unmanageable (and is carried over from update to update, gradually inflating)," the bug report explains.

Robotics engineer Iván López Broceño reports finding almost 200 GB of files that he believed he deleted. Web developer Chris Hayes said in the discussion thread that he found 44 GB of files in Snap's local Trash folder dating back two years.

Asked whether it's unusual for a bug like this to linger unfixed for more than a year, Hayes via email replied, "I'd say this is unusual when the risk is that the user can totally run out of space on their machine. In fact, that's how I first discovered it. I was running out of space, I pulled open Ubuntu's 'Disk Usage' and was pretty confused by how much space the VS Code snap was using."

Hayes, however, said he could understand how a bug like this might get lost in a massive repo like VS Code, which has 12,000+ open issues. He added that the number of Linux VSCode users using Snap is probably not all that small. Snap, he said, the default for the Ubuntu App Store, though the default for VS Code is .deb for Linux users rather than Snap.

"I feel like a lot of people don't know about this because either they haven't run out of space or they didn't dig into their disk space usage," he said. "The only other thing I'd add is running out of space on Linux can do some weird stuff, since Linux is so dependent on files for running everything. So, while this isn't a security vulnerability, it feels like it's getting lost in the sauce for something that can very much break your Linux machine. Not too long ago I was booting into a USB Linux to restore a corrupted file system on my desktop, it was probably for unrelated reasons, but it can definitely be a problem."

Comments

Loading comments...