Linux: Steam can (and will) delete all my files

[darkspir]

Hey Valve. You have a serious issue in your steam.sh on linux. You need to fix this and you need to fix this fast.

Okay. Tech-Talk. There is a function in your shellscript steam.sh called reset_steam(). In this function there is a line that should never be written in this form. And you know this because you left a comment in that code that shows your opinion of this:

# Scary!
rm -rf "$STEAMROOT/"*

Okay, what's the issue here? Well, if $STEAMROOT is set to null because it can't be located for whatever reason, this snippet here will not run as something like

rm -rf ~/.local/share/Steam/*

deleting everything in the Steam-Folder and below leaving the Steam folder itself empty but it will run as this:

rm -rf /*

And this will delete every file from the computer owned by the user who is running steam. Yes. If you are stupid enough to run steam as root, this will wipe e-v-e-r-y file from your system including every file on every disk/pendrive/sdcard that is currently mounted. So this is an example why you should never run this as root.

In my case nothing happened yet but I found some people on the internet who lost their entire home drive due to this crap.

The function reset_steam() will be called if you run steam.sh --reset or if the shellscript failed to start the steam binary. And yes, if $STEAMROOT is null, it will fail to start the steam binary and instead wipe your system. So, you see this is a serious issue.

Valve, what you should do RIGHT NOW is this:

rm -rf "$STEAMROOT" && mkdir "STEAMROOT"

This will delete the entire directory and recreate it empty. If $STEAMROOT is null, this will just throw an error because rm doesn't know what to delete. But it will not wipe the system.

Why should you do it RIGHT NOW? Because whenever I fix this for myself, steam sees that something within the installation is manipulated and downloads the latest update which restores the crappy shellscript.

So please: For the love of god: Fix this. I know that my fix can't handle cases where $STEAMROOT is null but your current script can't do that, too. And you can look for a better solution while your users data aren't in danger anymore by your software.

[darkspir]

Where do you have that from? Because that is not what I have on my computer. And whenever I change this file, Steam just restores it from the latest update...

[BuFFer]

rm -rf "$STEAMROOT" && mkdir "STEAMROOT"

[spoof]

your best bet for the right valve people is posting here.
http://steamcommunity.com/groups/SteamClientBeta

[BionicGimp]

I can confirm this is fixed in the latest beta version as vadim posted. On another machine running the Linux Beta, which has not has not run since the bug was publicized, the file is still faulty. I just opened steam on that computer and checked for a new client update. It downloaded, installed and now the bug is fixed. New file is date January 16, 2015.

[darkspir]

Funny thing is: Putting beta software on your system to get rid of critical bugs really feels like using linux. This is how I remember the last 8 years using Gentoo. :)