fix(site-publish): reject split input symlinks

Authored-By: OpenAI (GPT-5) <noreply@openai.com>
2026-08-29 22:30:43 +00:00
parent fb2e440bbb
commit 7b824a61ca
3 changed files with 23 additions and 2 deletions
@@ -219,6 +219,17 @@ class ConfigContractTests(unittest.TestCase):
            with self.assertRaisesRegex(ConfigError, "build inputs overlap after resolution"):
                validate_artifact_inputs(root, cfg)

+    def test_descendant_symlink_cannot_cross_artifact_boundary(self):
+        cfg = normalize_site_config(self.raw, "baseline.fritzlab.net")
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "dist").mkdir()
+            (root / "portal" / "build").mkdir(parents=True)
+            (root / "portal" / "build" / "private.txt").write_text("private")
+            (root / "dist" / "portal-link").symlink_to(root / "portal" / "build")
+            with self.assertRaisesRegex(ConfigError, "build input contains symlink"):
+                validate_artifact_inputs(root, cfg)
+

 class GenerationTests(unittest.TestCase):
    def render(self, raw):