bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 22:37:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix symlink escape in Gopher public file resolver

Browse source 
The userTree function confined selectors with path cleaning and HasPrefix
checks, but called os.Stat/os.ReadFile on the unresolved path. A symlink
created inside a member's public area pointing outside would pass the
lexical checks and leak external content.

Fix: resolve symlinks with filepath.EvalSymlinks after the path check
and reject the request if the real path escapes the member's area.

Adds TestSymlinkEscapeRefused to verify both rejection of external
symlinks and acceptance of symlinks within the member area.
This commit is contained in:
eouzoe 2026-07-09 21:25:14 +08:00
parent ff9eef907d
commit 671d0c5f9e
2 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
internal/gopher/server.go
View file

@ -310,6 +310,14 @@ func (s *Server) userTree(prefix, sel, area string) Response {
if target != base && !strings.HasPrefix(target, base+string(os.PathSeparator)) {
return errResp("forbidden")
}
// Symlink escape guard: resolve symlinks and re-check the real path stays
// within the member's area. A symlink created inside public_html that
// points outside would pass the lexical check but leak external content.
if resolved, err := filepath.EvalSymlinks(target); err == nil {
if resolved != base && !strings.HasPrefix(resolved, base+string(os.PathSeparator)) {
return errResp("forbidden")
}
}
info, err := os.Stat(target)
if err != nil {