[GH-ISSUE #106] symbolic links to external drives are not listed #47

Closed
opened 2026-04-08 16:50:02 +03:00 by zhus · 7 comments
Owner

Originally created by @notjedi on GitHub (Jul 17, 2022).
Original GitHub issue: https://github.com/sigoden/dufs/issues/106

Problem

as the title suggests, symbolic links linked to external disks are not listed.

Environment:

  • Dufs version: 0.26.0
  • Browser/Webdav Info: brave on android and librewolf on linux
  • OS Info: Arch Linux
Originally created by @notjedi on GitHub (Jul 17, 2022). Original GitHub issue: https://github.com/sigoden/dufs/issues/106 **Problem** as the title suggests, symbolic links linked to external disks are not listed. **Environment:** - Dufs version: `0.26.0` - Browser/Webdav Info: `brave` on android and `librewolf` on linux - OS Info: `Arch Linux`
zhus closed this issue 2026-04-08 16:50:02 +03:00
Author
Owner

@notjedi commented on GitHub (Jul 17, 2022):

similar projects that are not suffering from this issue:

  1. https://github.com/thecoshman/http
  2. https://github.com/svenstaro/miniserve
<!-- gh-comment-id:1186516930 --> @notjedi commented on GitHub (Jul 17, 2022): similar projects that are not suffering from this issue: 1. https://github.com/thecoshman/http 2. https://github.com/svenstaro/miniserve
Author
Owner

@notjedi commented on GitHub (Jul 17, 2022):

i can see that both the projects do something similar with fs::read_link, which dufs does not. here is a link to those lines:

7c1fa0e7bb/src/ops/webdav.rs (L148-L161)

55a23fa497/src/listing.rs (L248-L251)

<!-- gh-comment-id:1186520978 --> @notjedi commented on GitHub (Jul 17, 2022): i can see that both the projects do something similar with `fs::read_link`, which `dufs` does not. here is a link to those lines: https://github.com/thecoshman/http/blob/7c1fa0e7bb5277f201c898fc3f918265c848a0e7/src/ops/webdav.rs#L148-L161 https://github.com/svenstaro/miniserve/blob/55a23fa4973b3bc56952276382f4676ff9242ae9/src/listing.rs#L248-L251
Author
Owner

@sigoden commented on GitHub (Jul 17, 2022):

Do your run with option -A or --allow-symlink?

<!-- gh-comment-id:1186536622 --> @sigoden commented on GitHub (Jul 17, 2022): Do your run with option `-A` or `--allow-symlink`?
Author
Owner

@notjedi commented on GitHub (Jul 17, 2022):

it works after passing the -A option. but i think it makes more sense to allow symlinks by default. also there is lack of consistency here, because symlinks within the same drive are listed without the -A option.

<!-- gh-comment-id:1186545148 --> @notjedi commented on GitHub (Jul 17, 2022): it works after passing the `-A` option. but i think it makes more sense to allow symlinks by default. also there is lack of consistency here, because symlinks within the same drive are listed without the `-A` option.
Author
Owner

@sigoden commented on GitHub (Jul 17, 2022):

For security, dufs don't allow symlinks to dirctories outside the entrypoint directory unless runing with option -A or --allow-symlink.
For convenient, dufs do allow symlinks to directories inside the entrypoint directory.

These will satisfy most users.

<!-- gh-comment-id:1186548599 --> @sigoden commented on GitHub (Jul 17, 2022): For security, dufs don't allow symlinks to dirctories outside the entrypoint directory unless runing with option `-A` or `--allow-symlink`. For convenient, dufs do allow symlinks to directories inside the entrypoint directory. These will satisfy most users.
Author
Owner

@notjedi commented on GitHub (Jul 17, 2022):

cool, understood. but, do you mind telling me about the security concerns when it comes to external symlinks?

<!-- gh-comment-id:1186553227 --> @notjedi commented on GitHub (Jul 17, 2022): cool, understood. but, do you mind telling me about the security concerns when it comes to external symlinks?
Author
Owner

@sigoden commented on GitHub (Jul 18, 2022):

If you only want to serve a certain directory, but that directory has an symlink which links to /, you are actually exposing the entire filesystem.

<!-- gh-comment-id:1186630082 --> @sigoden commented on GitHub (Jul 18, 2022): If you only want to serve a certain directory, but that directory has an symlink which links to /, you are actually exposing the entire filesystem.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sigoden/dufs#47