ArchiveUtils: Also do not follow symbolic links to directories

The fix in 3342e50 was incomplete in that only symbolic links to files were not followed. Extend this to symbolic links to directories. Resolves #5376, again. Signed-off-by: Sebastian Schuberth <sebastian.schuberth@bosch.io>
oss-review-toolkit · May 25, 2022 · 42c98ed · 42c98ed
1 parent 31b648c
commit 42c98ed
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/utils/common/src/main/kotlin/ArchiveUtils.kt b/utils/common/src/main/kotlin/ArchiveUtils.kt
@@ -204,7 +204,7 @@ fun File.packZip(
         output.setLevel(Deflater.BEST_COMPRESSION)
 
         walkTopDown().onEnter {
-            directoryFilter(it)
+            Files.isDirectory(it.toPath(), LinkOption.NOFOLLOW_LINKS) && directoryFilter(it)
         }.filter {
             Files.isRegularFile(it.toPath(), LinkOption.NOFOLLOW_LINKS) && fileFilter(it) && it != targetFile
         }.forEach { file ->

diff --git a/utils/common/src/test/kotlin/ArchiveUtilsTest.kt b/utils/common/src/test/kotlin/ArchiveUtilsTest.kt
@@ -31,6 +31,7 @@ import io.kotest.matchers.string.shouldContain
 
 import java.io.File
 import java.io.IOException
+import java.nio.file.Files
 
 import org.apache.commons.compress.archivers.ArchiveEntry
 
@@ -413,6 +414,23 @@ class ArchiveUtilsTest : WordSpec() {
                 exception.message shouldContain noArchive.toString()
             }
         }
+
+        "packZip" should {
+            "not follow symbolic links".config(enabled = Os.isLinux) {
+                val inputDir = createTestTempDir()
+                val parentDir = inputDir.resolve("parent").apply { safeMkdirs() }
+                val readmeFile = parentDir.resolve("readme.txt").apply { writeText("Hello World!") }
+                Files.createSymbolicLink(parentDir.resolve("loop-link").toPath(), parentDir.toPath())
+                Files.createSymbolicLink(parentDir.resolve("readme-link.txt").toPath(), readmeFile.toPath())
+
+                val zipFile = inputDir.packZip(outputDir.resolve("archive.zip")) {
+                    it shouldBe readmeFile
+                    true
+                }
+
+                zipFile shouldBe aFile()
+            }
+        }
     }
 }