security(update): prevent tar extraction from traversing escaping symlinks - #943

Open

hazyhaar wants to merge 9 commits into

Gitlawb:mainfrom

hazyhaar:fix/tar-symlink-escape

Commits on Aug 28, 2026

security(update): prevent tar extraction from traversing escaping symlinks (fixes #920)

cl-ment
authored and
hazyhaar
committed
201e6fc
test(update): exercise chained symlink escape during file extract

cl-ment
authored and
hazyhaar
committed
d88c4d7
fix(update): resolve destDir symlinks and permit valid dangling symlinks in archive

cl-ment
authored and
hazyhaar
committed
9ec4c2b
docs(update): document POSIX-only scope for verifyNoSymlinkEscape
hazyhaar
committed
9645ce9
internal/update: test extracting files through directory symlinks
hazyhaar
committed
d558882

Commits on Aug 29, 2026

fix(update): reject dangling symlinks instead of lexical fallback
hazyhaar
committed
39ea2fa

Commits on Aug 30, 2026