mirror of
https://github.com/profullstack/agentbbs.git
synced 2026-08-13 22:37:28 +00:00
671d0c5f9e
The userTree function confined selectors with path cleaning and HasPrefix checks, but called os.Stat/os.ReadFile on the unresolved path. A symlink created inside a member's public area pointing outside would pass the lexical checks and leak external content. Fix: resolve symlinks with filepath.EvalSymlinks after the path check and reject the request if the real path escapes the member's area. Adds TestSymlinkEscapeRefused to verify both rejection of external symlinks and acceptance of symlinks within the member area. |
||
|---|---|---|
| .. | ||
| browser.go | ||
| gopher.go | ||
| gopher_test.go | ||
| listener.go | ||
| server.go | ||