[Issue 15584] Security issue: symlink attack

[via Digitalmars-d-bugs]

https://issues.dlang.org/show_bug.cgi?id=15584

--- Comment #3 from Cédric Picard <cpicard at openmailbox.org> ---
That may be true for gcc but I still think it is an issue. The classic setup
isn't with two plain files, an attacker would give a huge project through a
github repo for example and hide his link in layers of directories. An alert
user may notice it but that's true of all attacks. On the other end a less wise
user might just compile the project, in that case I'm definitive that getting
ssh access for example is possible (I did it on my machine).

Another argument in favor of simply removing symlinks is that this behaviour
isn't consistent. Object files get their symlinks replaced, and if the file
targetted by the symlink isn't empty the symlink gets removed too (which makes
for a less dangerous vulnerability as we can create a file or change it if
empty, but not change its content otherwise).

This should be corrected.

--