Distribution

Mint 21.2

Package version

1.6.4+victoria

Frequency

Always

Bug description

Warpinator cannot accept incoming files if the download location is a symbolic link. ('Location for received files' within the app)

The exact error returned is:

Resolved path is not a valid child of the save folder: [symlink path]/file -> [real path]/file

This was working in some prior release (within the last few weeks I expect, given when I last used the tool.

Steps to reproduce

1. Create a symbolic link to some valid directory you have read/write access to
2. Point Warpinator's download location to the symbolic link path
3. Attempt to send a file from another device to that instance of Warpinator

Expected behavior

The file should be downloaded successfully.

Additional information

I can see some argument as to whether following symbolic links would be dangerous, as it could allow an attack that leaks file contents out of the chosen download location.

In this case an exception should be made only for the Download directory itself, and not for any nested paths.

Alternatively if this is expected behaviour, there should be a warning or error provided when selecting a symbolic link as a download target.