Development record
internal/core/ideate/record.go's comment (around line 134) asserts that os.Root refuses every symlinked path component, but os.Root follows a relative symlink that stays inside the root; the release cross-check (x-044, v0.13.0) raised it and could not reproduce a write through it, so the claim and whatever guarantee leans on it are unverified.
issueresolvedminoriss-2610050259237102
internal/core/ideate/record.go's comment (around line 134) asserts that os.Root refuses every symlinked path component, but os.Root follows a relative symlink that stays inside the root; the release cross-check (x-044, v0.13.0) raised it and could not reproduce a write through it, so the claim and whatever guarantee leans on it are unverified.
Frontmatter
| id | iss-2610050259237102 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610050259237102-internal-core-ideate-record-go-s-comment.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610112206165535The doc comment on fsutil.IsRealDir (internal/fsutil/fsutil.go, ~621) says os.Root refuses symlink traversal at every level, the same false claim iss-2610050259237102 corrected in internal/core/ideate/record.go: os.Root refuses only a path that escapes the root and follows a symlink that stays inside it.