Fix prevention of direct symlink reads in resources.Get

* Note for themes, this is only an issue for themes stored locally, e.g. below `themes/...`. Themes mounted as modules from GitHub gets symlinks stripped away.
* Thas was also not an issue for file reading walking one or more directories.
* This is an regression introduced in `v0.123.0`.
This commit is contained in:
Bjørn Erik Pedersen
2026-05-11 12:52:53 +02:00
parent 86fbb0f7a8
commit f8b5fa09a6
5 changed files with 90 additions and 1 deletions
+19
View File
@@ -237,6 +237,21 @@ var commonTestScriptsParam = testscript.Params{
ts.Fatalf("failed to write file: %v", err)
}
},
// ln creates a symlink, but throws an error on Windows.
"ln": func(ts *testscript.TestScript, neg bool, args []string) {
if runtime.GOOS == "windows" {
ts.Fatalf("ln is not supported on Windows")
}
if len(args) != 2 {
ts.Fatalf("usage: ln TARGET LINKNAME")
}
target := ts.MkAbs(args[0])
linkname := ts.MkAbs(args[1])
err := os.Symlink(target, linkname)
if err != nil {
ts.Fatalf("failed to create symlink: %v", err)
}
},
// httpget checks that a HTTP resource's body matches (if it compiles as a regexp) or contains all of the strings given as arguments.
"httpget": func(ts *testscript.TestScript, neg bool, args []string) {
@@ -314,6 +329,10 @@ var commonTestScriptsParam = testscript.Params{
if !ok {
ts.Fatalf("stat %s: %v", filename, err)
}
if ok && neg {
// OK.
continue
}
if fi.Size() == 0 {
ts.Fatalf("%s is empty", filename)
}