fix(update): reject dangling symlinks instead of lexical fallback

EvalSymlinks failure used filepath.Clean on the link text, which does
not preserve already-traversed links. A dangling member is now an
error.

Author: hazyhaar

internal/update/extract.go

@@ -208,19 +208,7 @@ func verifyNoSymlinkEscape(destDirClean string, target string) error {
 		if info.Mode()&os.ModeSymlink != 0 {
 			resolved, err := filepath.EvalSymlinks(current)
 			if err != nil {
-				if os.IsNotExist(err) {
-					// Dangling symlink is allowed if its relative destination stays within destDir.
-					linkTarget, readErr := os.Readlink(current)
-					if readErr != nil {
-						return readErr
-					}
-					if filepath.IsAbs(linkTarget) {
-						return fmt.Errorf("archive symlink %s has absolute target: %s", current, linkTarget)
-					}
-					resolved = filepath.Clean(filepath.Join(filepath.Dir(current), linkTarget))
-				} else {
-					return err
-				}
+				return fmt.Errorf("archive symlink %s is dangling or unresolvable: %w", current, err)
 			}
 			resolved = filepath.Clean(resolved)
 			if resolved != destDirResolved && !strings.HasPrefix(resolved, destDirResolved+string(os.PathSeparator)) &&

internal/update/extract_test.go

@@ -381,3 +381,20 @@ func TestExtractTarGzRejectsChainedSymlinkEscapingFile(t *testing.T) {
 		t.Fatalf("escaped file exists outside destDir: %v", err)
 	}
 }
+
+func TestVerifyNoSymlinkEscapeRejectsDanglingLink(t *testing.T) {
+	if !symlinksSupported(t) {
+		t.Skip("symlinks not supported")
+	}
+	destDir := t.TempDir()
+	if err := os.Symlink("missing-target", filepath.Join(destDir, "d")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink("..", filepath.Join(destDir, "d", "s")); err == nil {
+		t.Log("created d/s through dangling d")
+	}
+	target := filepath.Join(destDir, "d", "s", "x")
+	if err := verifyNoSymlinkEscape(destDir, target); err == nil {
+		t.Fatal("expected dangling or unresolvable symlink to be rejected")
+	}
+}