Merge pull request #521 from oasisprotocol/ptrus/fix/artifacts-cleanup-linkpath

ptrus · web-flow · commit a2e65a9d50ad · 2025-07-11T10:14:33.000+02:00
rofl/build: Sanitize symlink target path
diff --git a/cmd/rofl/build/artifacts.go b/cmd/rofl/build/artifacts.go
@@ -184,7 +184,12 @@ FILES:
 			}
 		case tar.TypeSymlink:
 			// Symbolic link.
-			if err = os.Symlink(header.Linkname, path); err != nil {
+			var linkPath string
+			linkPath, err = cleanupPath(header.Linkname)
+			if err != nil {
+				return err
+			}
+			if err = os.Symlink(linkPath, path); err != nil {
 				return fmt.Errorf("failed to create soft link: %w", err)
 			}
 		case tar.TypeChar, tar.TypeBlock, tar.TypeFifo:

Original file line number	Diff line number	Diff line change
`@@ -184,7 +184,12 @@ FILES:`
`184`	`184`	`}`
`185`	`185`	`case tar.TypeSymlink:`
`186`	`186`	`// Symbolic link.`
`187`		`- if err = os.Symlink(header.Linkname, path); err != nil {`
	`187`	`+ var linkPath string`
	`188`	`+ linkPath, err = cleanupPath(header.Linkname)`
	`189`	`+ if err != nil {`
	`190`	`+ return err`
	`191`	`+ }`
	`192`	`+ if err = os.Symlink(linkPath, path); err != nil {`
`188`	`193`	`return fmt.Errorf("failed to create soft link: %w", err)`
`189`	`194`	`}`
`190`	`195`	`case tar.TypeChar, tar.TypeBlock, tar.TypeFifo:`