1 /* 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2026 Kaif Khan 5 * All rights reserved. 6 */ 7 #include "test.h" 8 9 /* 10 * A symlink whose target is a bare ".." (or a path ending in "/..") 11 * escapes the extraction directory just like "../" and "/../" do, so it 12 * must be rejected as insecure. 13 */ DEFINE_TEST(test_symlink_dotdot)14DEFINE_TEST(test_symlink_dotdot) 15 { 16 const char *reffile = "test_symlink_dotdot.zip"; 17 int r; 18 19 if (!canSymlink()) { 20 skipping("System cannot create symlinks."); 21 return; 22 } 23 24 assertUmask(0); 25 extract_reference_file(reffile); 26 27 r = systemf("%s %s >test.out 2>test.err", testprog, reffile); 28 assertEqualInt(0, r); 29 30 /* The two insecure symlinks must be skipped, not created. */ 31 assertFileNotExists("dotdot"); 32 assertFileNotExists("traildot"); 33 34 /* A regular entry in the same archive is still extracted. */ 35 assertIsReg("safe.txt", 0644); 36 } 37