fix: use lstat instead of stat in receive_thread (symlink security)

src/server/server.c

@@ -126,7 +126,8 @@ void handler(int file_descriptor) {
       close(file_descriptor);
       return;
     }
-    PipelineContextReceiver* context = pipeline_context_receiver_create(config, q, file_descriptor, ssl);
+    PipelineContextReceiver* context =
+        pipeline_context_receiver_create(config, q, file_descriptor, ssl);
     if (context == NULL) {
       queue_destroy(q);
       config_delete(config);

src/shared/multiprocessing.c

@@ -148,7 +148,7 @@ int receive_thread(void* pipeline_context) {
         }
         char* full_path = path_cat(config->receive_root_directory, check_path);
         struct stat st;
-        bool has_old = full_path && stat(full_path, &st) == 0;
+        bool has_old = full_path && lstat(full_path, &st) == 0;
         bool match = has_old && (unsigned long long)st.st_size == check_size &&
                      (long long)st.st_mtime == check_mtime;
         if (match)

tests/test_multiprocessing.c

@@ -116,7 +116,6 @@ static void test_receiver_fd_zero() {
   pipeline_context_receiver_destroy(ctx);
 }
 
-
 /* Test that receive_thread completes cleanly when sent FINISHED immediately */
 static void test_receive_thread_finished() {
   Config* cfg = config_create();