Destination containment is checked before file creation, but fopen/rename can follow a destination symlink or race with replacement of a validated directory component. A local attacker can redirect synchronized content outside the configured root. Safe-links validation also rejects absolute links without resolving relative targets against the containing directory.
Location
src/shared/file.c:217-241,541-614
src/client/scanner.c:170-182,397-410
Validation
Create destination/file as a symlink to an external target and transfer in-place; separately race a validated path component with a symlink. For safe-links, create source/sub/link -> ../../outside and scan with link-following options.
Suggested implementation
Use openat/openat2-style descriptor-relative traversal with O_NOFOLLOW, secure temporary creation and renameat within trusted directories, and canonical containment checks for resolved relative link targets. Add race-resistant filesystem tests.
## Severity
High
## Description
Destination containment is checked before file creation, but fopen/rename can follow a destination symlink or race with replacement of a validated directory component. A local attacker can redirect synchronized content outside the configured root. Safe-links validation also rejects absolute links without resolving relative targets against the containing directory.
## Location
- src/shared/file.c:217-241,541-614
- src/client/scanner.c:170-182,397-410
## Validation
Create destination/file as a symlink to an external target and transfer in-place; separately race a validated path component with a symlink. For safe-links, create source/sub/link -> ../../outside and scan with link-following options.
## Suggested implementation
Use openat/openat2-style descriptor-relative traversal with O_NOFOLLOW, secure temporary creation and renameat within trusted directories, and canonical containment checks for resolved relative link targets. Add race-resistant filesystem tests.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity
High
Description
Destination containment is checked before file creation, but fopen/rename can follow a destination symlink or race with replacement of a validated directory component. A local attacker can redirect synchronized content outside the configured root. Safe-links validation also rejects absolute links without resolving relative targets against the containing directory.
Location
Validation
Create destination/file as a symlink to an external target and transfer in-place; separately race a validated path component with a symlink. For safe-links, create source/sub/link -> ../../outside and scan with link-following options.
Suggested implementation
Use openat/openat2-style descriptor-relative traversal with O_NOFOLLOW, secure temporary creation and renameat within trusted directories, and canonical containment checks for resolved relative link targets. Add race-resistant filesystem tests.