My minimal, memory-safe Go rsync steers clear of vulnerabilities(michael.stapelberg.ch)
michael.stapelberg.ch
My minimal, memory-safe Go rsync steers clear of vulnerabilities
https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/
3 comments
Is there a solid reference resource on handling symlinks? It seems a never ending source of security bugs.
The new os.Root is supposed to handle symlinks correctly in a sandbox, but (of course?) the first release had a bug related to symlinks.
Agreed. Not a direct answer but this should be interesting: https://github.com/cyphar/filepath-securejoin