bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-14 06:47:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(gopher): block symlink escapes

Browse source
This commit is contained in:
rissrice2105-agent 2026-07-07 17:38:59 -06:00
parent ff9eef907d
commit 26a59d9332
2 changed files with 32 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/gopher/gopher_test.go
View file

@ -181,6 +181,23 @@ func TestPathTraversalRefused(t *testing.T) {
}
}
func TestSymlinkEscapeRefused(t *testing.T) {
srv, dataDir := newTestServer(t)
home := filepath.Join(dataDir, "users", "alice", "public_html")
link := filepath.Join(home, "leak.txt")
if err := os.Symlink(filepath.Join(dataDir, "secret.txt"), link); err != nil {
t.Skipf("symlink unavailable: %v", err)
}
r := srv.Resolve("/~alice/leak.txt", false, "")
if r.Kind != KindError {
t.Fatalf("symlink escape should be refused, got %v", r.Kind)
}
if strings.Contains(r.Text, "TOP SECRET") || strings.Contains(string(r.Data), "TOP SECRET") {
t.Fatalf("symlink escape leaked the secret file: %+v", r)
}
}
func TestNewsPublicVsAuthed(t *testing.T) {
srv, _ := newTestServer(t)