Fix symlink containment by converting virtual paths to real Windows paths via RealUserHomes dictionary

Author: PortaSFTPServer

ApacheMinaSSHD.NET.Wrapper/Internals/InternalSftpFileSystemAccessor.cs

@@ -52,7 +52,10 @@ public Path resolveLocalFilePath(SftpSubsystemProxy subsystem, Path rootDir, str
             Path finalPath = ToPath(managedPath, resolvedPath);
             Console.WriteLine($"[SRV] finalPath: {finalPath?.toString()}");
 
-            ValidateSymlinkContainment(finalPath, rootDir);
+            // Use real Windows paths for symlink containment when available.
+            // VirtualFileSystemView paths like "/outside-link.txt" are virtual and
+            // cannot be used with File.ResolveLinkTarget, FindFirstFile, etc.
+            ValidateSymlinkWithRealPath(subsystem, finalPath, rootDir, remotePath);
 
             var validationContext = CreateContext(
                 subsystem,
@@ -519,6 +522,65 @@ public bool noFollow(Collection opts)
             return fileSystemAccessor.NoFollow(context, defaultNoFollow);
         }
 
+        private void ValidateSymlinkWithRealPath(SftpSubsystemProxy subsystem, Path finalPath, Path rootDir, string remotePath)
+        {
+            Path effectivePath = finalPath;
+            Path effectiveRoot = rootDir;
+
+            try
+            {
+                if (InternalVirtualFileSystemFactory.RealUserHomes.TryGetValue(
+                        subsystem.getSession().getUsername(), out string? realUserHome))
+                {
+                    string pathStr = effectivePath.toString();
+                    // Convert virtual paths (Unix-style starting with '/') to real paths.
+                    // On Windows, real paths start with a drive letter so '/' always means virtual.
+                    // On Linux, both virtual and real paths start with '/', so we verify the path
+                    // is not already within the real root to avoid double-conversion.
+                    if (pathStr.StartsWith('/') && IsVirtualNotRealPath(pathStr, realUserHome))
+                    {
+                        string relativePath = pathStr.TrimStart('/');
+                        string realFilePath = System.IO.Path.GetFullPath(
+                            System.IO.Path.Combine(realUserHome, relativePath));
+                        string realRootPath = System.IO.Path.GetFullPath(realUserHome);
+
+                        effectivePath = Paths.get(realFilePath);
+                        effectiveRoot = Paths.get(realRootPath);
+                        Console.WriteLine($"[SRV] Real path for symlink check: {realFilePath}");
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine($"[SRV-DIAG] Failed to resolve real path, using virtual: {ex.GetType().Name}: {ex.Message}");
+            }
+
+            ValidateSymlinkContainment(effectivePath, effectiveRoot);
+        }
+
+        /// <summary>
+        /// Determines whether a Unix-style path (starting with '/') is a virtual path
+        /// rather than an already-resolved real path. On Windows, all paths starting with
+        /// '/' are virtual. On Linux, we check that the path does not already fall within
+        /// the real user home directory.
+        /// </summary>
+        private static bool IsVirtualNotRealPath(string path, string realUserHome)
+        {
+            if (OperatingSystem.IsWindows())
+            {
+                return true;
+            }
+
+            // On Linux, real paths also start with '/'. Check if this path is already
+            // a real path by verifying it isn't the real root or a child of it.
+            if (path.Length <= realUserHome.Length)
+            {
+                return !path.Equals(realUserHome, StringComparison.Ordinal);
+            }
+
+            return !path.StartsWith(realUserHome + "/", StringComparison.Ordinal);
+        }
+
         private void ValidateSymlinkContainment(Path filePath, Path rootDir)
         {
             string pathStr = filePath.toString();

ApacheMinaSSHD.NET.Wrapper/Internals/InternalVirtualFileSystemFactory.cs

@@ -3,20 +3,32 @@
 using org.apache.sshd.common.file;
 using org.apache.sshd.common.file.virtualfs;
 using org.apache.sshd.common.session;
+using System.Collections.Concurrent;
 
 namespace ApacheMinaSSHD.NET.Wrapper.Internals
 {
     internal sealed class InternalVirtualFileSystemFactory : java.lang.Object, FileSystemFactory
     {
         private readonly AMNetVirtualFileSystemFactory fileSystemFactory;
 
+        /// <summary>
+        /// Maps authenticated usernames to their real (Windows) home directory paths.
+        /// Used by <see cref="InternalSftpFileSystemAccessor"/> to convert virtual paths to
+        /// real filesystem paths for symlink containment validation.
+        /// </summary>
+        internal static readonly ConcurrentDictionary<string, string> RealUserHomes = new();
+
         public InternalVirtualFileSystemFactory(AMNetVirtualFileSystemFactory fileSystemFactory)
         {
             this.fileSystemFactory = fileSystemFactory;
         }
 
         java.nio.file.FileSystem FileSystemFactory.createFileSystem(SessionContext sessionContext)
         {
+            // Store the real user home path so that symlink detection can use real Windows paths.
+            string userHome = fileSystemFactory.ResolveUserHomeDirectory(sessionContext.getUsername());
+            RealUserHomes[sessionContext.getUsername()] = userHome;
+
             return CreateVirtualFileSystemFactory(sessionContext).createFileSystem(sessionContext);
         }