AI-written code failed to guard against dangling symlinks in Remove/RemoveAll, enabling writes outside the intended scope.

+		return nil, os.ErrPermission+	}+ 	dir, _ := path.Split(dst) 	err := afs.MkdirAll(dir, dirMode) 	if err != nil {

++	maxAuthBodySize = 1 << 20 // 1 MiB )  type userInfo struct {

 		if err != nil { 			return http.StatusInternalServerError, err@@ -142,7 +148,7 @@ type signupBody struct {

 	if err != nil {

+	// The path is a symlink. Refuse to follow it if its on-disk target escapes+	// the user's scoped root; otherwise a symlink that lives lexically inside+	// the scope but points outside it would let a restricted user read, write,+	// or share files beyond their boundary.+	if file != nil && file.IsSymlink {+		ok, scopeErr := WithinScope(opts.Fs, opts.Path)+		if scopeErr != nil || !ok {+			return nil, os.ErrPermission+		}+	}+ 	// fs doesn't support afero.Lstater interface or the file is a symlink 	info, err := opts.Fs.Stat(opts.Path) 	if err != nil {@@ -165,6 +176,50 @@ func stat(opts *FileOptions) (*FileInfo, error) { 	return file, nil } +// WithinScope reports whether the on-disk target of p — after resolving any+// symbolic links — stays within the scoped root of fsys. It exists to stop a+// symlink that lives lexically inside a user's scope but points outside it+// from being followed for reads, writes, or shares.+//+// Paths that do not exist yet (e.g. a brand-new file being created) are+// validated against their nearest existing ancestor, so legitimate new files+// are always allowed. For a filesystem that is not scoped with BasePathFs the+// check is a no-op and returns true.+//+// Note: a dangling symlink whose target does not yet exist resolves to its+// containing directory and is therefore allowed; writing through such a link+// could still create a file outside the scope. Callers that create files+// should treat this as best-effort and rely on rejecting existing escaping+// symlinks, which covers the disclosure and overwrite vectors.+func WithinScope(fsys afero.Fs, p string) (bool, error) {+	bfs, ok := fsys.(*afero.BasePathFs)+	if !ok {+		// Not a scoped filesystem; nothing to enforce.

+		if parent == target {+			break+		}+		target = parent+		resolved, err = filepath.EvalSymlinks(target)+	}+	if err != nil {+		return false, err+	}++	return resolved == root || strings.HasPrefix(resolved, root+string(filepath.Separator)), nil+}+ // Checksum checksums a given File for a given User, using a specific // algorithm. The checksums data is saved on File object. func (i *FileInfo) Checksum(algo string) error {

+	"strings" 	"testing" 	"time" @@ -14,6 +15,7 @@ import (  	"github.com/filebrowser/filebrowser/v2/diskcache" 	"github.com/filebrowser/filebrowser/v2/settings"+	"github.com/filebrowser/filebrowser/v2/storage" 	"github.com/filebrowser/filebrowser/v2/storage/bolt" 	"github.com/filebrowser/filebrowser/v2/users" )@@ -115,3 +117,108 @@ func signToken(t *testing.T, perm users.Permissions, key []byte) string { 	} 	return signed }++// scopedUserStorage returns a storage whose single user (ID 1) is scoped to+// userScope through a symlink-confining ScopedFs (via customFSUser), mirroring+// production. Used by the symlink scope-escape regression tests below.+func scopedUserStorage(t *testing.T, userScope string, perm users.Permissions, key []byte) *storage.Storage {+	t.Helper()+	db, err := storm.Open(filepath.Join(t.TempDir(), "db"))+	if err != nil {+		t.Fatalf("failed to open db: %v", err)+	}+	t.Cleanup(func() { _ = db.Close() })++	st, err := bolt.NewStorage(db)+	if err != nil {+		t.Fatalf("failed to get storage: %v", err)+	}+	if err := st.Users.Save(&users.User{Username: "u", Password: "pw", Perm: perm}); err != nil {+		t.Fatalf("failed to save user: %v", err)+	}+	if err := st.Settings.Save(&settings.Settings{Key: key}); err != nil {+		t.Fatalf("failed to save settings: %v", err)+	}+	st.Users = &customFSUser{+		Store: st.Users,+		fs:    afero.NewBasePathFs(afero.NewOsFs(), userScope),+	}+	return st+}++// Regression for the dangling-symlink write escape (GHSA-8wc8-hf36-mjh9 /

+	for _, d := range []string{userScope, outside} {+		if err := os.MkdirAll(d, 0o755); err != nil {+			t.Fatal(err)+		}+	}+	// A dangling symlink inside the scope pointing at a not-yet-existing file+	// outside it (planted out-of-band, per the advisory preconditions).+	outsideTarget := filepath.Join(outside, "created.txt")+	if err := os.Symlink(outsideTarget, filepath.Join(userScope, "evil")); err != nil {+		t.Skipf("cannot create symlink: %v", err)+	}++	key := []byte("test-signing-key")+	perm := users.Permissions{Create: true, Modify: true}+	st := scopedUserStorage(t, userScope, perm, key)+	signed := signToken(t, perm, key)++	req, _ := http.NewRequest(http.MethodPost, "/evil?override=true", strings.NewReader("http-outside"))+	req.Header.Set("X-Auth", signed)+	rec := httptest.NewRecorder()+	handle(resourcePostHandler(diskcache.NewNoOp()), "", st, &settings.Server{}).ServeHTTP(rec, req)++	if _, statErr := os.Stat(outsideTarget); statErr == nil {

++// Regression for the symlink-following delete escape (GHSA-hq4g-mpch-f9vp /+// GHSA-fmm7-x4gx-8jhr): a Create-only user POSTing to a child of an escaping

+// maxSymlinkHops bounds how many dangling symlinks within() will follow before+// giving up, so a pathological chain cannot loop forever. It mirrors the kernel+// MAXSYMLINKS limit; the operation is rejected once the bound is exceeded.+const maxSymlinkHops = 255+ func NewScopedFs(source afero.Fs, path string) *ScopedFs { 	if s, ok := source.(*ScopedFs); ok { 		source = s.base@@ -61,13 +66,10 @@ func (s *ScopedFs) guard(name string) error { // // Paths that do not exist yet (e.g. a brand-new file being created) are // validated against their nearest existing ancestor, so legitimate new files-// are always allowed.-//-// Note: a dangling symlink whose target does not yet exist resolves to its-// containing directory and is therefore allowed; writing through such a link-// could still create a file outside the scope. This is treated as best-effort-// and relies on rejecting existing escaping symlinks, which covers the-// disclosure and overwrite vectors.+// are always allowed. A dangling symlink — a link whose target does not exist+// yet — is the exception: it is followed to where it points and validated+// there, so a write cannot dereference the link to create a file outside the+// scope. func (s *ScopedFs) within(p string) (bool, error) { 	root, err := filepath.EvalSymlinks(afero.FullBaseFsPath(s.base, "/")) 	if err != nil {@@ -76,12 +78,43 @@ func (s *ScopedFs) within(p string) (bool, error) {  	target := afero.FullBaseFsPath(s.base, p) 	resolved, err := filepath.EvalSymlinks(target)-	for errors.Is(err, fs.ErrNotExist) {-		parent := filepath.Dir(target)-		if parent == target {-			break+	// When target does not resolve, work out where the operation would actually+	// land. A non-existent regular path resolves to the file that would be+	// created inside its containing directory, so walk up to the nearest+	// existing ancestor and validate that. But when target itself is a dangling+	// symlink, follow it one level instead: validating its lexical parent would+	// wrongly accept a link pointing outside the scope, letting a write follow+	// the link and create the file out of bounds.+	for hops := 0; errors.Is(err, fs.ErrNotExist); {

+				return false, rerr+			}+			if !filepath.IsAbs(dest) {+				// Resolve the link relative to the directory that really contains+				// it, not its lexical parent: a symlinked ancestor could otherwise+				// shift the computed target back into scope while the real write+				// lands outside it. The parent is guaranteed to resolve here+				// because os.Lstat above already traversed it.+				base, berr := filepath.EvalSymlinks(filepath.Dir(target))+				if berr != nil {+					return false, berr+				}+				dest = filepath.Join(base, dest)+			}+			target = filepath.Clean(dest)+		} else {+			parent := filepath.Dir(target)+			if parent == target {+				break+			}+			target = parent 		}-		target = parent 		resolved, err = filepath.EvalSymlinks(target) 	} 	if err != nil {@@ -136,10 +169,16 @@ func (s *ScopedFs) OpenFile(name string, flag int, perm os.FileMode) (afero.File }  func (s *ScopedFs) Remove(name string) error {+	if err := s.guard(name); err != nil {+		return err+	} 	return s.base.Remove(name) }  func (s *ScopedFs) RemoveAll(path string) error {

+	// parent directory, so OpenFile(O_CREATE) dereferenced the link and created+	// the file at its out-of-scope target.+	t.Run("write through a dangling escaping symlink is rejected", func(t *testing.T) {+		base := t.TempDir()+		scope := filepath.Join(base, "scope")+		outside := filepath.Join(base, "outside")+		for _, d := range []string{scope, outside} {+			if err := os.MkdirAll(d, 0o755); err != nil {+				t.Fatal(err)+			}+		}+		outsideTarget := filepath.Join(outside, "created.txt") // does not exist yet+		if err := os.Symlink(outsideTarget, filepath.Join(scope, "evil")); err != nil {+			t.Skipf("cannot create symlink: %v", err)+		}+		fs := NewScopedFs(afero.NewOsFs(), scope)++		f, err := fs.OpenFile("/evil", os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)+		if err == nil {+			_ = f.Close()+			t.Fatal("VULNERABLE: write through a dangling escaping symlink was allowed")+		}+		if !os.IsPermission(err) {+			t.Fatalf("expected permission error, got %v", err)+		}+		if _, statErr := os.Stat(outsideTarget); statErr == nil {+			t.Fatal("VULNERABLE: file was created outside the scope")+		}+	})++	// A dangling *relative* symlink that lives under an escaping directory+	// symlink must be resolved against the link's real directory, not its lexical+	// parent. Otherwise the symlinked ancestor can shift the computed target back+	// into scope while the real OS write lands outside it.+	t.Run("write through a dangling relative symlink under a symlinked dir is rejected", func(t *testing.T) {+		base := t.TempDir()+		scope := filepath.Join(base, "scope")+		outside := filepath.Join(base, "outside")+		for _, d := range []string{scope, outside} {+			if err := os.MkdirAll(d, 0o755); err != nil {+				t.Fatal(err)+			}+		}+		// An escaping directory symlink inside the scope: /scope/m -> /base/outside.+		if err := os.Symlink(outside, filepath.Join(scope, "m")); err != nil {+			t.Skipf("cannot create symlink: %v", err)+		}+		// A relative dangling symlink inside the escaping dir whose target,+		// resolved against the real directory (/base/outside), is /base/escaped —+		// outside the scope.+		if err := os.Symlink("../escaped", filepath.Join(outside, "evil")); err != nil {+			t.Skipf("cannot create symlink: %v", err)+		}+		fs := NewScopedFs(afero.NewOsFs(), scope)++		f, err := fs.OpenFile("/m/evil", os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)+		if err == nil {+			_ = f.Close()+			t.Fatal("VULNERABLE: write through a dangling relative symlink under a symlinked dir was allowed")+		}+		if !os.IsPermission(err) {+			t.Fatalf("expected permission error, got %v", err)+		}+		if _, statErr := os.Stat(filepath.Join(base, "escaped")); statErr == nil {+			t.Fatal("VULNERABLE: file was created outside the scope")+		}+	})++	// Regression for the symlink-following delete escape (GHSA-hq4g-mpch-f9vp /+	// GHSA-fmm7-x4gx-8jhr): Remove/RemoveAll used to skip guard(), so RemoveAll+	// followed a symlinked ancestor escaping the scope and deleted an+	// out-of-scope file.+	t.Run("RemoveAll through an escaping symlink is rejected", func(t *testing.T) {+		base := t.TempDir()+		scope := filepath.Join(base, "scope")+		outside := filepath.Join(base, "outside")+		for _, d := range []string{scope, outside} {+			if err := os.MkdirAll(d, 0o755); err != nil {+				t.Fatal(err)+			}+		}+		victim := filepath.Join(outside, "victim.txt")