Skip to content

fix(component): tighten symlinks validation#18683

Open
nijel wants to merge 1 commit intoWeblateOrg:mainfrom
nijel:download-cleanup
Open

fix(component): tighten symlinks validation#18683
nijel wants to merge 1 commit intoWeblateOrg:mainfrom
nijel:download-cleanup

Conversation

@nijel
Copy link
Member

@nijel nijel commented Mar 27, 2026

Use the symlink validation in download paths and gettext add-ons.

@nijel nijel added this to the 5.17 milestone Mar 27, 2026
@nijel nijel requested review from amCap1712 and Copilot March 27, 2026 12:42
@nijel nijel self-assigned this Mar 27, 2026
@nijel nijel requested a review from AliceVisek as a code owner March 27, 2026 12:42
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Tightens repository symlink validation across download/export paths and Gettext-related add-ons to prevent including or modifying files that resolve outside the repository tree.

Changes:

  • Use validated component-managed filenames (template/new_base/intermediate) when building download ZIP contents; skip invalid symlink targets.
  • Apply symlink validation to discovery/alerts logic that checks auxiliary component files.
  • Add regression tests covering symlinked targets in downloads, discovery/alerts checks, new-language creation, API ZIP downloads, and Gettext add-ons.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
weblate/trans/views/files.py Uses validated component filename getters when collecting files for ZIP downloads; skips invalid symlink targets.
weblate/trans/models/component.py Adds get_validated_component_filename() helper; validates symlinks when creating new language files.
weblate/trans/models/alert.py Validates component auxiliary files before checking existence for alerts.
weblate/trans/discovery.py Validates auxiliary file paths during discovery skip-reason checks.
weblate/addons/gettext.py Adds symlink validation around LINGUAS/configure-related file operations.
weblate/addons/tests.py Adds tests ensuring Gettext add-ons reject symlinked files and don’t modify outside-repo targets.
weblate/trans/tests/test_files.py Adds test asserting downloads exclude symlinked template files.
weblate/api/tests.py Adds test asserting API ZIP downloads exclude symlinked template (test name currently mismatched).
weblate/trans/tests/test_newlang.py Adds test rejecting symlinked destination directory during new language creation.
weblate/trans/tests/test_discovery.py Adds test treating symlinked auxiliary discovery base file as “does not exist.”
weblate/trans/tests/test_alert.py Adds test treating symlinked auxiliary base file as missing for alerts.
docs/changes.rst Documents the symlink validation behavior change.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Use the symlink validation in download paths and gettext add-ons.
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@argos-ci
Copy link

argos-ci bot commented Mar 27, 2026

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build Status Details Updated (UTC)
default (Inspect) ⚠️ Changes detected (Review) 20 changed Mar 27, 2026, 1:56 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants