Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Decide whether path checks should follow symlinks

Open
  • Is something wrong?
#196 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript, node.js
Domain
backend, security

Research direction

Read pathSecurity.js first, then compare removeInsideProject in themeUpdateService.js with uploadSourcePath in exportController.js. Decide whether these paths should reject symlinks or whether the project storage assumption should be documented. Done means recording that decision and implementing it with a test, or documenting the assumption.

Written by the indexing model from the issue text.

Description

question

Refuse shortcut folders inside a project, or document that they're not supported.

The containment checks that keep file-sourced paths inside their folder compare resolved path strings and do not follow symlinks: the theme-update recovery plan (themeUpdateService.js removeInsideProject) and export's media copy (exportController.js uploadSourcePath). A symlink already inside uploads/images that points outside would still be copied on export, and a plan entry through a symlinked folder would still be removed. Neither import nor theme upload can create one (utils/zipSafety.js writes every entry as a plain file), so this needs a local actor or an embedding app whose storage preserves symlinks. Options: lstat/realpath these paths and refuse symlinks, or document the assumption that project folders hold no symlinks.

Done when: The decision is made and either implemented with a test or documented.

Start: themeUpdateService.js, exportController.js, pathSecurity.js. Source: 2026-10-06 reviews of the BACKUP-TRUST fixes.

Dominant language
JavaScript
Stars
162
Forks
6
Avg merge
12h 55m
Merged PRs (30d)
2

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tsiger/widgetizer

All issues in tsiger/widgetizer

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.