1*185becb1SMartin Matuska /* 2*185becb1SMartin Matuska * SPDX-License-Identifier: BSD-2-Clause 3*185becb1SMartin Matuska * 4*185becb1SMartin Matuska * Copyright (c) 2026 Kaif Khan 5*185becb1SMartin Matuska * All rights reserved. 6*185becb1SMartin Matuska */ 7*185becb1SMartin Matuska #include "test.h" 8*185becb1SMartin Matuska 9*185becb1SMartin Matuska /* 10*185becb1SMartin Matuska * A symlink whose target is a bare ".." (or a path ending in "/..") 11*185becb1SMartin Matuska * escapes the extraction directory just like "../" and "/../" do, so it 12*185becb1SMartin Matuska * must be rejected as insecure. 13*185becb1SMartin Matuska */ DEFINE_TEST(test_symlink_dotdot)14*185becb1SMartin MatuskaDEFINE_TEST(test_symlink_dotdot) 15*185becb1SMartin Matuska { 16*185becb1SMartin Matuska const char *reffile = "test_symlink_dotdot.zip"; 17*185becb1SMartin Matuska int r; 18*185becb1SMartin Matuska 19*185becb1SMartin Matuska if (!canSymlink()) { 20*185becb1SMartin Matuska skipping("System cannot create symlinks."); 21*185becb1SMartin Matuska return; 22*185becb1SMartin Matuska } 23*185becb1SMartin Matuska 24*185becb1SMartin Matuska assertUmask(0); 25*185becb1SMartin Matuska extract_reference_file(reffile); 26*185becb1SMartin Matuska 27*185becb1SMartin Matuska r = systemf("%s %s >test.out 2>test.err", testprog, reffile); 28*185becb1SMartin Matuska assertEqualInt(0, r); 29*185becb1SMartin Matuska 30*185becb1SMartin Matuska /* The two insecure symlinks must be skipped, not created. */ 31*185becb1SMartin Matuska assertFileNotExists("dotdot"); 32*185becb1SMartin Matuska assertFileNotExists("traildot"); 33*185becb1SMartin Matuska 34*185becb1SMartin Matuska /* A regular entry in the same archive is still extracted. */ 35*185becb1SMartin Matuska assertIsReg("safe.txt", 0644); 36*185becb1SMartin Matuska } 37