mirror of
https://github.com/tauri-apps/plugins-workspace.git
synced 2026-10-10 22:38:44 +02:00
Lucas Fernandes Nogueira
3a9000177c
In plugins/fs/src/commands.rs resolve_path / is_forbidden, only paths that already existed were canonicalized, so a new file below a symlinked directory in the scope was matched by its unresolved path and written outside of the scope. Relative symlink targets were resolved against the process CWD, only the link target was checked against deny patterns, and resolution errors made is_forbidden fail open. resolve_path now computes the real path (canonical nearest existing ancestor + remaining components, following dangling symlinks relative to their parent, bounded to 40 links) and checks it against the allow and deny patterns; deny patterns also match the path as given. Resolution errors fail closed. Unit tests cover symlinked ancestors, relative and dangling links and loops.