fix(update): resolve intermediate symlink parents and cap Root link depth

Walk each path component from the physical parent, reject a ninth link,
and look up release binaries through OpenRoot as regular files only.

Author: hazyhaar

internal/update/extract.go

@@ -216,39 +216,17 @@ func validateSymlinkTarget(root *os.Root, parentRel, linkTarget string) error {
 	return err
 }
 
+const maxRootSymlinks = 8
+
 func followUnderRoot(root *os.Root, rel string, depth int) (string, error) {
-	if depth > 255 {
-		return "", fmt.Errorf("archive symlink nest exceeds limit")
-	}
 	if rel == "" || rel == "." {
 		return ".", nil
 	}
-	info, err := root.Lstat(rel)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return rel, nil
-		}
-		return "", err
-	}
-	if info.Mode()&os.ModeSymlink == 0 {
-		return rel, nil
-	}
-	tgt, err := root.Readlink(rel)
-	if err != nil {
-		return "", err
-	}
-	if filepath.IsAbs(tgt) || strings.HasPrefix(tgt, "/") {
-		return "", fmt.Errorf("archive symlink %s has absolute target: %s", rel, tgt)
-	}
-	parent := filepath.Dir(rel)
-	if parent == "" {
-		parent = "."
-	}
-	return walkUnderRoot(root, parent, tgt, depth+1)
+	return walkUnderRoot(root, ".", rel, depth)
 }
 
 func walkUnderRoot(root *os.Root, base, linkTarget string, depth int) (string, error) {
-	if depth > 255 {
+	if depth > maxRootSymlinks {
 		return "", fmt.Errorf("archive symlink nest exceeds limit")
 	}
 	current := base
@@ -285,7 +263,15 @@ func walkUnderRoot(root *os.Root, base, linkTarget string, depth int) (string, e
 			current = next
 			continue
 		}
-		followed, err := followUnderRoot(root, next, depth+1)
+		tgt, err := root.Readlink(next)
+		if err != nil {
+			return "", err
+		}
+		if filepath.IsAbs(tgt) || strings.HasPrefix(tgt, "/") || strings.HasPrefix(tgt, "\\") ||
+			filepath.VolumeName(tgt) != "" || strings.Contains(tgt, ":") {
+			return "", fmt.Errorf("archive symlink %s has absolute target: %s", next, tgt)
+		}
+		followed, err := walkUnderRoot(root, current, tgt, depth+1)
 		if err != nil {
 			return "", err
 		}
@@ -299,16 +285,25 @@ func walkUnderRoot(root *os.Root, base, linkTarget string, depth int) (string, e
 // helper binaries nested under archive subdirectories (e.g. helpers/) are
 // still found.
 func findByBasename(root string, name string) (string, error) {
+	destRoot, err := os.OpenRoot(root)
+	if err != nil {
+		return "", err
+	}
+	defer destRoot.Close()
 	var found string
-	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error {
+	err = fs.WalkDir(destRoot.FS(), ".", func(path string, entry fs.DirEntry, walkErr error) error {
 		if walkErr != nil {
 			return walkErr
 		}
 		if found != "" {
 			return fs.SkipAll
 		}
-		if !entry.IsDir() && entry.Name() == name {
-			found = path
+		if entry.Type().IsRegular() && entry.Name() == name {
+			if path == "." {
+				found = filepath.Join(root, name)
+			} else {
+				found = filepath.Join(root, filepath.FromSlash(path))
+			}
 		}
 		return nil
 	})

internal/update/extract_test.go

@@ -4,6 +4,7 @@ import (
 	"archive/tar"
 	"archive/zip"
 	"compress/gzip"
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -258,21 +259,23 @@ func TestExtractTarGzAllowsSafeSymlink(t *testing.T) {
 	}
 
 	// Cover a linked subdirectory with a file extracted through the link.
+	// Windows Root.Symlink needs the directory target to exist first so the
+	// link is created as a directory junction rather than a file symlink.
 	h3 := &tar.Header{
-		Name:     "sublink",
-		Typeflag: tar.TypeSymlink,
-		Linkname: "subdir",
+		Name:     "subdir",
+		Typeflag: tar.TypeDir,
+		Mode:     0o755,
 	}
 	if err := tw.WriteHeader(h3); err != nil {
-		t.Fatalf("WriteHeader sublink: %v", err)
+		t.Fatalf("WriteHeader subdir: %v", err)
 	}
 	h4 := &tar.Header{
-		Name:     "subdir",
-		Typeflag: tar.TypeDir,
-		Mode:     0o755,
+		Name:     "sublink",
+		Typeflag: tar.TypeSymlink,
+		Linkname: "subdir",
 	}
 	if err := tw.WriteHeader(h4); err != nil {
-		t.Fatalf("WriteHeader subdir: %v", err)
+		t.Fatalf("WriteHeader sublink: %v", err)
 	}
 	h5 := &tar.Header{
 		Name:     "sublink/nested.txt",
@@ -532,3 +535,60 @@ func TestExtractTarGzRejectsSymlinkThroughSymlinkParentOutsideTarget(t *testing.
 		t.Fatalf("file outside destDir was accessed/created: %v", err)
 	}
 }
+
+func TestExtractTarGzRejectsIntermediateDirSymlinkEscape(t *testing.T) {
+	if !symlinksSupported(t) {
+		t.Skip("symlinks not supported")
+	}
+	dir := t.TempDir()
+	destDir := filepath.Join(dir, "extracted")
+	outside := filepath.Join(dir, "archive.tar.gz.outside")
+	if err := os.WriteFile(outside, []byte("secret"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	archivePath := filepath.Join(dir, "archive.tar.gz")
+	writeTestTarGzEntries(t, archivePath, []testTarEntry{
+		{name: "d", typeflag: tar.TypeSymlink, linkname: "."},
+		{name: "d/a", typeflag: tar.TypeDir},
+		{name: "d/a/zero", typeflag: tar.TypeSymlink, linkname: "../../archive.tar.gz.outside"},
+	})
+	if err := extractArchive(archivePath, destDir); err == nil {
+		t.Fatal("expected reject of ../../ escape through intermediate dir symlink")
+	}
+	if _, err := os.Lstat(filepath.Join(destDir, "d", "a", "zero")); err == nil {
+		t.Fatal("escaping link must not be created")
+	}
+}
+
+func TestFollowUnderRootRejectsNinthLink(t *testing.T) {
+	if !symlinksSupported(t) {
+		t.Skip("symlinks not supported")
+	}
+	dir := t.TempDir()
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+	if err := os.Mkdir(filepath.Join(dir, "leaf"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	prev := "leaf"
+	for i := 0; i < maxRootSymlinks; i++ {
+		name := fmt.Sprintf("l%d", i)
+		if err := os.Symlink(prev, filepath.Join(dir, name)); err != nil {
+			t.Fatal(err)
+		}
+		prev = name
+	}
+	if _, err := followUnderRoot(root, prev, 0); err != nil {
+		t.Fatalf("eight links must resolve: %v", err)
+	}
+	ninth := "l8"
+	if err := os.Symlink(prev, filepath.Join(dir, ninth)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := followUnderRoot(root, ninth, 0); err == nil {
+		t.Fatal("ninth link must be rejected")
+	}
+}