umputun / local-docs-mcp

86%

master: 86%

Pull #6

github

Resolve symlinks for path traversal check, drop substring guard

Previously, SafeResolvePath relied on `strings.Contains(path, "..")` plus a
lexical `filepath.Rel` boundary check. The substring check has false
positives on legitimate filenames (`a..b.md`, `....md`), and the Rel check
is purely lexical -- a symlink inside baseDir pointing to `/etc/passwd`
passes both and the file gets read. The existing symlink test was written
permissively and silently masked the bypass.

After this change, the check is split in two: a precise lexical check
catches above-root traversals (`../etc/passwd`) without rejecting filenames
that merely contain `..`, and `filepath.EvalSymlinks` resolves both base
and target so the boundary check sees the real filesystem path. Intra-base
symlinks remain allowed; symlinks escaping baseDir are rejected as
traversal. The symlink test now requires the error.

Resolves #5

16 of 22 new or added lines in 1 file covered. (72.73%)

704 of 817 relevant lines covered (86.17%)

24.75 hits per line