Method revalidate_unlink_path

src/linker.rs:217–291

Re-validate a path before unlinking (remove_file/remove_dir). Unlike revalidate_path, this does NOT canonicalize the final component, allowing safe removal of symlinks that point outside project_root. The symlink entry itself must be within project_root, but its target can be anywhere.

(&self, path: &Path)

    /// allowing safe removal of symlinks that point outside project_root.
    /// The symlink entry itself must be within project_root, but its target can be anywhere.
    fn revalidate_unlink_path(&self, path: &Path) -> Result<()> {
        let display_path = path.display().to_string();

        // SECURITY: Reject absolute paths
        if path.is_absolute() {
            // If path is already absolute and under project_root, validate parent only
            if !path.starts_with(&self.project_root) {
                anyhow::bail!("Path is outside project root: {}", display_path);
            }
            // For absolute paths under project_root, validate the parent directory
            if let Some(parent) = path.parent() {
                let canonical_parent = self.canonicalize_uncached(parent).with_context(|| {
                    format!("Failed to canonicalize parent: {}", parent.display())
                })?;

                let canonical_root = self.get_canonical_project_root()?;

                if !canonical_parent.starts_with(&canonical_root) {
                    anyhow::bail!(
                        "Path parent resolves outside project root: {}",
                        display_path
                    );
                }
            }
            return Ok(());
        }

        // SECURITY: Reject paths with ParentDir components before resolution
        for component in path.components() {
            if matches!(component, Component::ParentDir) {
                anyhow::bail!(
                    "Path contains parent directory (..) component: {}",
                    display_path
                );
            }
        }

        // Validate that the parent directory (if any) is within project_root
        // We canonicalize the parent but NOT the final component (which might be a symlink)
        if let Some(parent) = path.parent() {
            if parent.as_os_str().is_empty() {
                // Path has no parent (e.g., just a filename), it's relative to project_root
                return Ok(());
            }

            let parent_absolute = if parent.is_absolute() {
                parent.to_path_buf()
            } else {
                self.project_root.join(parent)
            };

            // Only canonicalize if the parent exists; for cleanup operations the parent might not exist yet
            if parent_absolute.exists() {
                let canonical_parent =
                    self.canonicalize_uncached(&parent_absolute)
                        .with_context(|| {
                            format!(
                                "Failed to canonicalize parent: {}",