Refuse fetch writes through a symlink in the destination (closes #86)

sanitizePath checks manifest paths only as text, so a symlink already
inside the destination directory could send fetch's writes outside it.
checkNoSymlinks now looks at each existing part of a path with os.Lstat
and refuses the path if any part is a symlink, wherever it points.
fetch runs it immediately before each write: creating the parent
directories, creating the temp file, and renaming it into place. The new
test puts such a symlink at each of those three places, and once inside
a plain directory, and checks that the fetch fails and nothing outside
changes. The G304 comment now states what holds. A symlink swapped in
between a check and its write is not caught; os.Root closes that once
the Go version is raised.

Model: opus-5-5

internal/cli/fetch.go

@@ -53,6 +53,9 @@ var (
 	// errPathTraversal indicates a manifest path escaping the target
 	// directory.
 	errPathTraversal = errors.New("path traversal not allowed")
+	// errSymlinkInPath indicates a manifest path running through a
+	// symlink that already exists in the target directory.
+	errSymlinkInPath = errors.New("symlink in path not allowed")
 	// errSizeMismatch indicates a downloaded file with an unexpected
 	// size.
 	errSizeMismatch = errors.New("size mismatch")
@@ -274,6 +277,35 @@ func sanitizePath(p string) (string, error) {
 	return cleaned, nil
 }
 
+// checkNoSymlinks returns an error if any part of the relative path p
+// already exists as a symlink. sanitizePath checks p only as text, so
+// without this a symlink inside the target directory could send a write
+// to p outside of it. Parts that do not exist yet are fine: fetch creates
+// them as plain directories and files. Call it immediately before each
+// write: a symlink created after it returns is not caught.
+func checkNoSymlinks(p string) error {
+	current := ""
+
+	for _, part := range strings.Split(p, string(filepath.Separator)) {
+		current = filepath.Join(current, part)
+
+		info, err := os.Lstat(current)
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("failed to check %s for a symlink: %w", current, err)
+		}
+
+		if info.Mode()&os.ModeSymlink != 0 {
+			return fmt.Errorf("%w: %s", errSymlinkInPath, current)
+		}
+	}
+
+	return nil
+}
+
 // resolveManifestURL takes a URL and returns the manifest URL.
 // If the URL already ends with .mf, it's returned as-is.
 // Otherwise, index.mf is appended.
@@ -419,7 +451,12 @@ func downloadFile(
 	// Create parent directories if needed
 	dir := filepath.Dir(localPath)
 	if dir != "" && dir != "." {
-		err := os.MkdirAll(dir, dirPerms)
+		err = checkNoSymlinks(dir)
+		if err != nil {
+			return err
+		}
+
+		err = os.MkdirAll(dir, dirPerms)
 		if err != nil {
 			return fmt.Errorf("failed to create directory %s: %w", dir, err)
 		}
@@ -447,14 +484,16 @@ func downloadFile(
 		totalBytes = expectedSize
 	}
 
+	err = checkNoSymlinks(tmpPath)
+	if err != nil {
+		return err
+	}
+
 	// Create temp file.
 	//
-	// G304: tmpPath is derived from localPath, which sanitizePath above
-	// constrains lexically to a relative path that does not escape the
-	// destination directory. That is a purely lexical guarantee: it does
-	// not resolve symlinks, so a pre-existing symlink inside the
-	// destination tree can still redirect this write outside of it
-	// (tracked in issue #86).
+	// G304: tmpPath is a relative path that sanitizePath keeps inside the
+	// target directory as text, and checkNoSymlinks just found no symlink
+	// in it.
 	out, err := os.Create(tmpPath) //nolint:gosec // G304: see comment above
 	if err != nil {
 		return fmt.Errorf("failed to create temp file: %w", err)
@@ -519,6 +558,11 @@ func finishDownload(
 		return err
 	}
 
+	err = checkNoSymlinks(localPath)
+	if err != nil {
+		return err
+	}
+
 	// Rename temp file to final path
 	err = os.Rename(tmpPath, localPath)
 	if err != nil {