fix(realfs): use no-follow resolver for stat/read_link/remove#1584
Merged
Conversation
`RealFs::resolve` canonicalizes any existing path, so a final symlink
component was always followed. As a result:
- stat('/link') returned the target's metadata
- read_link('/link') tried readlink on the target and failed
- remove('/link', recursive=true) called remove_dir_all on the target,
which on read-write mounts could wipe an arbitrary directory tree
Add `resolve_no_follow` that canonicalizes only the parent, validates
containment under the mount root, and appends the basename verbatim.
Switch stat/read_link/remove to it. `remove` now also branches on
symlink_metadata so a symlink is unlinked even when `recursive=true`.
Add four regression tests in realfs.rs covering each operation,
including a check that removing a symlink to an outside path leaves
the outside tree untouched.
Closes #1578
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 0cadb87 | Commit Preview URL Branch Preview URL |
May 07 2026, 04:10 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1578.
Summary
RealFs::resolvecanonicalizes any existing path, so a final symlink component was always followed before the operation ran. The resulting bugs:stat('/link')returned the target's metadata, not the symlink's.read_link('/link')triedreadlinkon the canonicalized target and failed.remove('/link', recursive=true)reachedremove_dir_allon the target — on read-write mounts that could wipe an arbitrary directory tree (thedangling -> /outside-dircase is the worst).Fix
resolve_no_followthat canonicalizes only the parent (so symlink hops in any parent component are still verified), checks containment under the mount root, then appends the basename verbatim.stat,read_link, andremoveto the new resolver.removenow branches onsymlink_metadataso a symlink is unlinked withremove_fileeven whenrecursive=true.Tests
Four new regression tests in
realfs::tests:stat_describes_symlink_not_targetread_link_returns_target_for_link_pathremove_unlinks_symlink_without_following(verifies the target tree is intact)remove_symlink_with_recursive_flag_outside_target_intact(link points outside root, target stays untouched)Test plan
cargo test -p bashkit --lib --features realfs fs::realfs(32/32 passing)cargo test -p bashkit --features realfs --test realfs_tests(35/35 passing)cargo fmt --all -- --checkcargo clippy -p bashkit --features realfs,ssh --all-targets -- -D warningsGenerated by Claude Code