bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(gopher): block symlink escapes (#85)
Some checks failed
CI / build (push) Has been cancelled
Details
deploy / deploy (push) Has been cancelled
Details
test / test (push) Has been cancelled
Details

Browse source 
Co-authored-by: rissrice2105-agent <rissrice2105-agent@users.noreply.github.com>
This commit is contained in:
RissRIce 2026-07-10 03:33:34 -06:00 • committed by GitHub
parent e38c0935f4
commit c2a06f1cdf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 32 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/gopher/gopher_test.go
View file

@ -181,6 +181,23 @@ func TestPathTraversalRefused(t *testing.T) {
}
}
func TestSymlinkEscapeRefused(t *testing.T) {
srv, dataDir := newTestServer(t)
home := filepath.Join(dataDir, "users", "alice", "public_html")
link := filepath.Join(home, "leak.txt")
if err := os.Symlink(filepath.Join(dataDir, "secret.txt"), link); err != nil {
t.Skipf("symlink unavailable: %v", err)
}
r := srv.Resolve("/~alice/leak.txt", false, "")
if r.Kind != KindError {
t.Fatalf("symlink escape should be refused, got %v", r.Kind)
}
if strings.Contains(r.Text, "TOP SECRET") || strings.Contains(string(r.Data), "TOP SECRET") {
t.Fatalf("symlink escape leaked the secret file: %+v", r)
}
}
func TestNewsPublicVsAuthed(t *testing.T) {
srv, _ := newTestServer(t)