From a5447965e7808d656a5e5d9326a9ca0231148f85 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Mon, 5 Oct 2026 19:30:49 -0400
Subject: feat: sym-link containment, batch count prompt for crafting

---
 internal/admin/correct_audit_fixes_test.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'internal/admin/correct_audit_fixes_test.go')

diff --git a/internal/admin/correct_audit_fixes_test.go b/internal/admin/correct_audit_fixes_test.go
index d97732d..d7b713e 100644
--- a/internal/admin/correct_audit_fixes_test.go
+++ b/internal/admin/correct_audit_fixes_test.go
@@ -73,3 +73,19 @@ func TestUndoFailureIsReportedDistinctly(t *testing.T) {
 		t.Fatal("empty history must be a clean nil change and nil error")
 	}
 }
+
+// Regression: a symlink inside data/ pointing outside it must not let the raw
+// file API read or write outside the data directory.
+func TestResolveDataPathRejectsSymlinkEscape(t *testing.T) {
+	dir := t.TempDir()
+	outside := t.TempDir()
+	if err := os.Symlink(outside, filepath.Join(dir, "link")); err != nil {
+		t.Skipf("symlinks unsupported: %v", err)
+	}
+	if _, err := resolveDataPath(dir, "link/secret.yaml"); err == nil {
+		t.Fatal("a symlink escaping the data directory was accepted")
+	}
+	if _, err := resolveDataPath(dir, "rooms/1.yaml"); err != nil {
+		t.Fatalf("normal path rejected: %v", err)
+	}
+}
-- 
cgit v1.2.3