umputun / weblist / 32429054433

84%

push

github

Revert "fix: refuse symlinks that escape the served root"

This reverts commit 6ddae20.

os.Root refuses any absolute symlink target, including links that
resolve inside the served root, so a tree built with absolute
symlinks would list those entries and 404 on access. That is a
wider behavior change than the escape it was meant to close.

The escape itself is real and still open: os.DirFS only guarantees
opened paths start with the root, so a symlink inside the root
reaches outside it over both HTTP and SFTP, contradicting the
readme's "locked to the root directory".

1 of 1 new or added line in 1 file covered. (100.0%)

2061 of 2447 relevant lines covered (84.23%)

25.06 hits per line