Merge commit from fork

resolveWritePath enforced the workingDir write boundary with a lexical
filepath.Rel check. This prevented "../" path escapes but did not resolve
symlinks: a path component under workingDir pointing to an external
directory (e.g. "out" -> "/outside") passed the check, causing writes to
land outside workingDir when AllowPathTraversalOnWrite=false.

Fix: after the lexical check, call checkSymlinkEscape, which resolves
symlinks in workingDir and in the deepest existing ancestor of the write
target, then verifies the resulting real path is still under the real
workingDir. The helper realPathForWrite walks up to the deepest existing
ancestor before calling EvalSymlinks so it handles write targets whose
parent directories do not yet exist.

Add TestStore_resolveWritePath_SymlinkTraversal with two sub-tests:
- a symlink component under workingDir escaping the boundary is blocked
- a regular subdirectory write within workingDir continues to work

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Author: TerryHowe

content/file/file.go

@@ -625,6 +625,13 @@ func (s *Store) resolveWritePath(name string) (string, error) {
 		if strings.HasPrefix(rel, "../") || rel == ".." {
 			return "", ErrPathTraversalDisallowed
 		}
+		// The lexical check above prevents "../" escapes but does not resolve
+		// symlinks. A symlink component under workingDir (e.g. "out" -> "/outside")
+		// passes the lexical check yet directs writes outside workingDir.
+		// Re-check after resolving symlinks in the parent path to close that gap.
+		if err := checkSymlinkEscape(base, target); err != nil {
+			return "", err
+		}
 	}
 	if s.DisableOverwrite {
 		if _, err := os.Stat(path); err == nil {
@@ -686,3 +693,52 @@ func (s *Store) setClosed() {
 func ensureDir(path string) error {
 	return os.MkdirAll(path, 0777)
 }
+
+// checkSymlinkEscape returns ErrPathTraversalDisallowed if resolving symlinks
+// in target's ancestor directories causes it to escape base. target may not
+// yet exist, so symlinks are resolved on its deepest existing ancestor.
+func checkSymlinkEscape(base, target string) error {
+	realBase, err := filepath.EvalSymlinks(base)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil // base doesn't exist yet; no symlinks to follow
+		}
+		return err
+	}
+	realTarget, err := realPathForWrite(target)
+	if err != nil {
+		return err
+	}
+	rel, err := filepath.Rel(realBase, realTarget)
+	if err != nil {
+		return ErrPathTraversalDisallowed
+	}
+	rel = filepath.ToSlash(rel)
+	if strings.HasPrefix(rel, "../") || rel == ".." {
+		return ErrPathTraversalDisallowed
+	}
+	return nil
+}
+
+// realPathForWrite resolves symlinks in the deepest existing ancestor of path
+// and returns the resulting absolute path. Non-existent path components are
+// appended verbatim, matching the semantics of a file about to be created.
+func realPathForWrite(path string) (string, error) {
+	dir := filepath.Dir(path)
+	suffix := filepath.Base(path)
+	for {
+		real, err := filepath.EvalSymlinks(dir)
+		if err == nil {
+			return filepath.Join(real, suffix), nil
+		}
+		if !os.IsNotExist(err) {
+			return "", err
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return path, nil // reached filesystem root
+		}
+		suffix = filepath.Join(filepath.Base(dir), suffix)
+		dir = parent
+	}
+}

content/file/file_test.go

@@ -3295,6 +3295,63 @@ func TestStore_resolveWritePath_PathTraversal(t *testing.T) {
 	}
 }
 
+func TestStore_resolveWritePath_SymlinkTraversal(t *testing.T) {
+	// GHSA-8xwf-rjm4-xvhv: resolveWritePath used a lexical filepath.Rel check
+	// that passed for names like "out/secret.txt" even when "out" is a symlink
+	// pointing outside workingDir.
+	t.Run("symlink component in workingDir escaping write boundary is blocked", func(t *testing.T) {
+		tempDir := t.TempDir()
+		outside := filepath.Join(tempDir, "outside")
+		if err := os.MkdirAll(outside, 0755); err != nil {
+			t.Fatal(err)
+		}
+		workingDir := filepath.Join(tempDir, "store")
+		if err := os.MkdirAll(workingDir, 0755); err != nil {
+			t.Fatal(err)
+		}
+		// "store/out" is a symlink to a directory outside workingDir.
+		if err := os.Symlink(outside, filepath.Join(workingDir, "out")); err != nil {
+			t.Skip("symlinks not available:", err)
+		}
+
+		s, err := New(workingDir)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer s.Close()
+
+		// "out/secret.txt" passes the lexical check but follows the symlink
+		// to outside/secret.txt, escaping workingDir.
+		_, err = s.resolveWritePath("out/secret.txt")
+		if !errors.Is(err, ErrPathTraversalDisallowed) {
+			t.Errorf("resolveWritePath() error = %v, want %v", err, ErrPathTraversalDisallowed)
+		}
+	})
+
+	t.Run("regular subdirectory write within workingDir still works", func(t *testing.T) {
+		tempDir := t.TempDir()
+		workingDir := filepath.Join(tempDir, "store")
+		subDir := filepath.Join(workingDir, "sub")
+		if err := os.MkdirAll(subDir, 0755); err != nil {
+			t.Fatal(err)
+		}
+
+		s, err := New(workingDir)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer s.Close()
+
+		got, err := s.resolveWritePath("sub/file.txt")
+		if err != nil {
+			t.Fatalf("resolveWritePath() unexpected error: %v", err)
+		}
+		if want := filepath.Join(workingDir, "sub/file.txt"); got != want {
+			t.Errorf("resolveWritePath() = %v, want %v", got, want)
+		}
+	})
+}
+
 func TestStore_resolveWritePath_Overwrite(t *testing.T) {
 	t.Run("Target file already exists", func(t *testing.T) {
 		tempDir := t.TempDir()