symbolic links to external drives are not listed about dufs

[sigoden]

For security, dufs don't allow symlinks to dirctories outside the entrypoint directory unless runing with option -A or --allow-symlink.
For convenient, dufs do allow symlinks to directories inside the entrypoint directory.

These will satisfy most users.

[sigoden]

If you only want to serve a certain directory, but that directory has an symlink which links to /, you are actually exposing the entire filesystem.

[notjedi]

similar projects that are not suffering from this issue:

1. https://github.com/thecoshman/http
2. https://github.com/svenstaro/miniserve

[notjedi]

i can see that both the projects do something similar with fs::read_link, which dufs does not. here is a link to those lines:

https://github.com/thecoshman/http/blob/7c1fa0e7bb5277f201c898fc3f918265c848a0e7/src/ops/webdav.rs#L148-L161

https://github.com/svenstaro/miniserve/blob/55a23fa4973b3bc56952276382f4676ff9242ae9/src/listing.rs#L248-L251

[sigoden]

Do your run with option -A or --allow-symlink?

[notjedi]

it works after passing the -A option. but i think it makes more sense to allow symlinks by default. also there is lack of consistency here, because symlinks within the same drive are listed without the -A option.

[notjedi]

cool, understood. but, do you mind telling me about the security concerns when it comes to external symlinks?