udpated changelog

CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file. For commit
 ## v2.1.5
 
  **Security**:
+ - [High] Server-side archive create (`POST /api/resources/archive`) now resolves the full destination path for writes via symlink-scoped mutation resolution, closing arbitrary host file overwrite through an in-scope symlink leaf (GHSA-jg32-ppcc-ph62) reporter @manus-use
  - [Moderate] `GET /api/media/subtitles` no longer follows symlink external subtitle sidecars beside the video file, and public share requests resolve sidecar paths under the share prefix before read (GHSA-hfvf-2639-p2mq) reporter @manus-use
  - [Moderate] Directory motion-preview now resolves symlinked children within the caller's scope, closing the incomplete GHSA-g2q5 remediation path through `getDirectoryPreview` (GHSA-2546-vf4j-vh9v) reporter @manus-use
  - [Moderate] RealPathCache entries for affected index paths are invalidated after symlink-scoped mutations so stale resolved paths cannot bypass containment on subsequent create, write, delete, or move operations (GHSA-j764-qg3m-rhv7 follow-up, #3381)

backend/internal/web/archive.go

@@ -279,19 +279,18 @@ func archiveCreateHandler(w http.ResponseWriter, r *http.Request, d *Context) (i
 	if fullDestParent != fullDestFile && !state.AccessPermitted(idxTo.Path, utils.IndexPathFromNormalized(fullDestParent, true), d.User.Username) {
 		return http.StatusForbidden, fmt.Errorf("access denied to destination parent of %s", req.Destination)
 	}
-	parentReal, err := idxTo.GetRealPathForMutation(userScopeTo, fullDestParent)
-	if err != nil {
-		return http.StatusBadRequest, fmt.Errorf("destination parent path invalid: %v", err)
-	}
-	if err = os.MkdirAll(parentReal, fileutils.EffectiveDirPerm()); err != nil {
-		return http.StatusInternalServerError, fmt.Errorf("cannot create destination parent directory: %v", err)
-	}
 	destRel := strings.TrimLeft(filepath.ToSlash(req.Destination), "/")
 	fileName := path.Base(destRel)
 	if fileName == "." || fileName == "/" {
 		return http.StatusBadRequest, fmt.Errorf("invalid destination file name")
 	}
-	destFileReal := filepath.Join(parentReal, fileName)
+	destFileReal, err := idxTo.GetRealPathForMutation(userScopeTo, fullDestFile)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("destination path invalid: %v", err)
+	}
+	if err = os.MkdirAll(filepath.Dir(destFileReal), fileutils.EffectiveDirPerm()); err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("cannot create destination parent directory: %v", err)
+	}
 
 	format := strings.ToLower(strings.TrimSpace(req.Format))
 	if format == "" {

backend/internal/web/archive_test.go

@@ -3,11 +3,16 @@ package web
 import (
 	"archive/tar"
 	"archive/zip"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+
+	commonerrors "github.com/gtsteffaniak/filebrowser/backend/internal/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
 func TestNormalizeArchiveEntryName(t *testing.T) {
@@ -557,3 +562,19 @@ func TestExtractZip_symlinkDestination(t *testing.T) {
 		t.Fatalf("victim.txt should be unchanged: %q, %v", victimData, err)
 	}
 }
+
+func TestArchiveCreateDestination_RejectsEscapingSymlinkLeaf(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	outside := filepath.Join(filepath.Dir(root), "outside-archive")
+	if err := os.MkdirAll(outside, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "report.zip")); err != nil {
+		t.Fatal(err)
+	}
+	idx := &indexing.Index{Source: settings.Source{Path: root}}
+	if _, err := idx.GetRealPathForMutation("", "/report.zip"); !errors.Is(err, commonerrors.ErrPathEscapesScope) {
+		t.Fatalf("expected ErrPathEscapesScope, got %v", err)
+	}
+}