fix: reject symlinks in template copying - #57

Draft

cloudcarver wants to merge 1 commit into

mainfrom

agent/security-template-copy-symlinks

cloudcarver commented Jul 31, 2026

Owner

Summary

open source and destination trees through rooted filesystem handles
reject source symlinks and non-regular source entries
reject symlinked destination parents and final files
preserve normal template suffix and permission behavior
add external-sentinel regression tests

Validation

go test ./...
go test -race ./dev/tools
go vet ./...

Closes #42


          fix: reject template copy symlinks

884b23d

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet