{"record":{"id":"502c1afa830c9d3f","repo":"astrid-runtime/astrid","slug":"malicious-archive-detected-symlinks-are-not-allow","errorCode":null,"errorMessage":"Malicious archive detected: symlinks are not allowed ('{}')","messagePattern":"Malicious archive detected: symlinks are not allowed \\('(.+?)'\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/archive.rs","lineNumber":377,"sourceCode":"\n        if entry_path.is_absolute()\n            || entry_path\n                .components()\n                .any(|c| matches!(c, std::path::Component::ParentDir))\n        {\n            bail!(\n                \"Malicious archive detected: invalid path '{}'\",\n                entry_path.display()\n            );\n        }\n\n        let out_path = unpack_dir.join(&entry_path);\n        if let Some(parent) = out_path.parent() {\n            std::fs::create_dir_all(parent)?;\n        }\n\n        if entry.header().entry_type().is_symlink() || entry.header().entry_type().is_hard_link() {\n            bail!(\n                \"Malicious archive detected: symlinks are not allowed ('{}')\",\n                entry_path.display()\n            );\n        }\n\n        entry\n            .unpack(&out_path)\n            .with_context(|| format!(\"Failed to unpack file: {}\", out_path.display()))?;\n    }\n\n    match installed_authority {\n        Some(authority) => install_from_local_path_internal(\n            unpack_dir,\n            home,\n            options,\n            target_principal,\n            workspace,\n            expected,","sourceCodeStart":359,"sourceCodeEnd":395,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/archive.rs#L359-L395","documentation":"Fired by unpack_and_install_internal when a tar entry is a symlink or hard link. Link entries could redirect installed files outside the unpack directory, so capsule archives must contain only regular files and directories.","triggerScenarios":"Thrown at crates/astrid-capsule-install/src/archive.rs:377 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject this archive; links are not permitted in capsule packages","Repack the archive with links resolved to real files","Report the malicious archive to the publisher"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}