The firefox-cache rule lists /mozilla/firefox/profiles as a pattern with verdict safe.
On Windows the Firefox profile lives at %APPDATA%\Mozilla\Firefox\Profiles\<id>\, which normalizes to /mozilla/firefox/profiles/... — so the pattern matches the whole profile, not a cache inside it. That covers places.sqlite (bookmarks and history), logins.json and cookies.sqlite. They get shown under "Safe to remove" in the app and quarantine_finding accepts them.
The other pattern in the same rule (/.cache/mozilla/firefox) is fine — that one really is cache-only. The Windows cache is under %LOCALAPPDATA%\Mozilla\Firefox\Profiles\<id>\cache2, so pointing at that instead would keep the rule honest.
crates/diskern-core/rules/base.json:27
Worth adding a test alongside the DriverStore one asserting a logins.json path does not come back safe.
The
firefox-cacherule lists/mozilla/firefox/profilesas a pattern with verdictsafe.On Windows the Firefox profile lives at
%APPDATA%\Mozilla\Firefox\Profiles\<id>\, which normalizes to/mozilla/firefox/profiles/...— so the pattern matches the whole profile, not a cache inside it. That coversplaces.sqlite(bookmarks and history),logins.jsonandcookies.sqlite. They get shown under "Safe to remove" in the app andquarantine_findingaccepts them.The other pattern in the same rule (
/.cache/mozilla/firefox) is fine — that one really is cache-only. The Windows cache is under%LOCALAPPDATA%\Mozilla\Firefox\Profiles\<id>\cache2, so pointing at that instead would keep the rule honest.crates/diskern-core/rules/base.json:27Worth adding a test alongside the DriverStore one asserting a
logins.jsonpath does not come backsafe.