fix: reject dangling symlinks escaping sandbox in FsSandbox::resolve

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

host/src/lib.rs

@@ -767,6 +767,35 @@ impl FsSandbox {
         let mut out = resolved_ancestor;
         for name in tail.into_iter().rev() {
             out.push(name);
+            // Catch symlinks in the non-existing tail — including dangling ones.
+            if let Ok(meta) = std::fs::symlink_metadata(&out) {
+                if meta.file_type().is_symlink() {
+                    let target = std::fs::read_link(&out)?;
+                    let abs = if target.is_absolute() {
+                        target
+                    } else {
+                        out.parent().unwrap_or(&self.root).join(&target)
+                    };
+                    // Normalise the absolute target (resolve .. etc) without
+                    // touching the filesystem, then check the prefix.
+                    let mut norm = std::path::PathBuf::new();
+                    for c in abs.components() {
+                        match c {
+                            std::path::Component::ParentDir => {
+                                norm.pop();
+                            }
+                            std::path::Component::CurDir => {}
+                            c => norm.push(c),
+                        }
+                    }
+                    if !norm.starts_with(&self.root) {
+                        return Err(anyhow!(
+                            "symlink target escapes mount root: {:?}",
+                            guest_path
+                        ));
+                    }
+                }
+            }
         }
         Ok(out)
     }
@@ -2488,6 +2517,74 @@ mod tests {
         assert!(err.contains("escapes mount root"), "{err}");
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn test_resolve_dangling_symlink_escape() {
+        use std::os::unix::fs::symlink;
+        let root = tmpdir("dangling-escape");
+        // Create a dangling symlink whose target is outside root.
+        symlink("/tmp/nonexistent-outside-root", root.join("bad_link")).unwrap();
+        let fs_sb = FsSandbox::new(&root).unwrap();
+        let err = fs_sb.resolve("bad_link").unwrap_err().to_string();
+        assert!(
+            err.contains("escapes mount root"),
+            "expected escape error, got: {err}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_resolve_valid_internal_symlink() {
+        use std::os::unix::fs::symlink;
+        let root = tmpdir("valid-internal");
+        fs::write(root.join("real_file.txt"), "hello").unwrap();
+        symlink(root.join("real_file.txt"), root.join("good_link")).unwrap();
+        let fs_sb = FsSandbox::new(&root).unwrap();
+        let resolved = fs_sb.resolve("good_link").unwrap();
+        // The symlink target is inside root, so resolve should succeed.
+        assert!(
+            resolved.starts_with(&root),
+            "expected path under root, got: {resolved:?}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_resolve_dangling_symlink_inside_root() {
+        use std::os::unix::fs::symlink;
+        let root = tmpdir("dangling-inside");
+        // Dangling symlink whose target is inside root (just doesn't exist yet).
+        symlink(root.join("future_file.txt"), root.join("ok_link")).unwrap();
+        let fs_sb = FsSandbox::new(&root).unwrap();
+        // This should be allowed — the target is within root even though it
+        // doesn't exist yet.
+        let resolved = fs_sb.resolve("ok_link").unwrap();
+        assert!(
+            resolved.starts_with(&root),
+            "expected path under root, got: {resolved:?}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_resolve_symlink_chain_escape() {
+        use std::os::unix::fs::symlink;
+        let root = tmpdir("chain-escape");
+        let outside = tmpdir("chain-outside");
+        // symlink B -> outside (dangling or not, target is outside root)
+        symlink(&outside, root.join("link_b")).unwrap();
+        // symlink A -> link_b
+        symlink(root.join("link_b"), root.join("link_a")).unwrap();
+        let fs_sb = FsSandbox::new(&root).unwrap();
+        // Resolving link_a should fail because it chains through link_b
+        // which points outside root.
+        let err = fs_sb.resolve("link_a").unwrap_err().to_string();
+        assert!(
+            err.contains("escapes mount root"),
+            "expected escape error, got: {err}"
+        );
+    }
+
     #[test]
     fn resolve_allows_paths_under_the_root() {
         let root = tmpdir("allow");