Cover symlink attacks with test cases

2020-10-01 21:13:42 -07:00
parent 90ae815b1d
commit e3e89a2ecc
2 changed files with 208 additions and 1 deletions
--- a/server/filesystem/filesystem.go
+++ b/server/filesystem/filesystem.go
@@ -332,7 +332,7 @@ func (fs *Filesystem) Delete(p string) error {
 		return errors.New("cannot delete root server directory")
 	}

-	if st, err := os.Stat(resolved); err != nil {
+	if st, err := os.Lstat(resolved); err != nil {
 		if !os.IsNotExist(err) {
 			fs.error(err).Warn("error while attempting to stat file before deletion")
 		}