fix(storage): harden backup root validation

Author: ndycode

lib/storage.ts

@@ -1,6 +1,12 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
-import { existsSync, promises as fs, realpathSync, type Dirent } from "node:fs";
+import {
+	existsSync,
+	lstatSync,
+	promises as fs,
+	realpathSync,
+	type Dirent,
+} from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { ACCOUNT_LIMITS } from "./constants.js";
 import { createLogger } from "./logger.js";
@@ -2026,9 +2032,14 @@ export function assertNamedBackupRestorePath(
 	backupRoot: string,
 ): string {
 	const resolvedPath = resolvePath(path);
-	const resolvedBackupRoot = resolvePathForNamedBackupContainment(backupRoot);
+	const resolvedBackupRoot = resolvePath(backupRoot);
+	if (existsSync(resolvedBackupRoot) && lstatSync(resolvedBackupRoot).isSymbolicLink()) {
+		throw new Error("Backup path escapes backup directory");
+	}
+	const canonicalBackupRoot =
+		resolvePathForNamedBackupContainment(resolvedBackupRoot);
 	const containedPath = resolvePathForNamedBackupContainment(resolvedPath);
-	const relativePath = relative(resolvedBackupRoot, containedPath);
+	const relativePath = relative(canonicalBackupRoot, containedPath);
 	const firstSegment = relativePath.split(/[\\/]/)[0];
 	if (
 		relativePath.length === 0 ||
@@ -2037,7 +2048,7 @@ export function assertNamedBackupRestorePath(
 	) {
 		throw new Error("Backup path escapes backup directory");
 	}
-	return resolvedPath;
+	return containedPath;
 }
 
 export function isNamedBackupContainmentError(error: unknown): boolean {

test/storage.test.ts

@@ -1896,6 +1896,41 @@ describe("storage", () => {
 			).toThrow(/escapes backup directory/i);
 		});
 
+		it("rejects symlinked backup roots during restore path validation", async () => {
+			const canonicalBackupRoot = join(testWorkDir, "canonical-backups");
+			const linkedBackupRoot = join(testWorkDir, "linked-backups");
+			const backupPath = join(canonicalBackupRoot, "linked-root.json");
+			await fs.mkdir(canonicalBackupRoot, { recursive: true });
+			await fs.writeFile(
+				backupPath,
+				JSON.stringify({
+					version: 3,
+					activeIndex: 0,
+					accounts: [
+						{
+							accountId: "linked-root",
+							refreshToken: "ref-linked-root",
+							addedAt: 1,
+							lastUsed: 1,
+						},
+					],
+				}),
+				"utf-8",
+			);
+			await fs.symlink(
+				resolve(canonicalBackupRoot),
+				linkedBackupRoot,
+				process.platform === "win32" ? "junction" : "dir",
+			);
+
+			expect(() =>
+				assertNamedBackupRestorePath(
+					join(linkedBackupRoot, "linked-root.json"),
+					linkedBackupRoot,
+				),
+			).toThrow(/escapes backup directory/i);
+		});
+
 		it("rejects named backup listings whose resolved paths escape the backups directory", async () => {
 			const backupRoot = join(dirname(testStoragePath), "backups");
 			const originalReaddir = fs.readdir.bind(fs);
@@ -2252,7 +2287,9 @@ describe("storage", () => {
 				expect(listedBackups).toEqual(
 					expect.arrayContaining([
 						expect.objectContaining({
-							name: "chunk-boundary-08",
+							name: `chunk-boundary-${String(
+								NAMED_BACKUP_LIST_CONCURRENCY,
+							).padStart(2, "0")}`,
 							valid: true,
 						}),
 					]),