1 files changed, 16 insertions, 0 deletions
diff --git a/internal/admin/correct_audit_fixes_test.go b/internal/admin/correct_audit_fixes_test.go
index d97732d..d7b713e 100644
--- a/internal/admin/correct_audit_fixes_test.go
+++ b/internal/admin/correct_audit_fixes_test.go
@@ -73,3 +73,19 @@ func TestUndoFailureIsReportedDistinctly(t *testing.T) {
 		t.Fatal("empty history must be a clean nil change and nil error")
 	}
 }
+
+// Regression: a symlink inside data/ pointing outside it must not let the raw
+// file API read or write outside the data directory.
+func TestResolveDataPathRejectsSymlinkEscape(t *testing.T) {
+	dir := t.TempDir()
+	outside := t.TempDir()
+	if err := os.Symlink(outside, filepath.Join(dir, "link")); err != nil {
+		t.Skipf("symlinks unsupported: %v", err)
+	}
+	if _, err := resolveDataPath(dir, "link/secret.yaml"); err == nil {
+		t.Fatal("a symlink escaping the data directory was accepted")
+	}
+	if _, err := resolveDataPath(dir, "rooms/1.yaml"); err != nil {
+		t.Fatalf("normal path rejected: %v", err)
+	}
+}