---
id: fb59a187-80c0-4c80-a6f9-3de604f9843d
title: inbox-dir symlink into www exposes private submissions
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T18:08:32.906968950Z
updated: 2026-10-27T18:20:51.846193895Z
---
## What

`ensure_inbox_outside_www()` only compares lexical paths; `serve` static file lookup follows symlinks inside `www`.

`src/serve.rs:175-186`.

## Reproduced

```
mkdir -p /tmp/www/private
ln -s /tmp/www/private /tmp/inbox-link
hu13 serve --www /tmp/www --inbox-dir /tmp/inbox-link --listen 127.0.0.1:39332
curl http://127.0.0.1:39332/private/leak.json
```

Startup succeeds (the inbox path is lexically outside `/tmp/www`), and the file is served with `200`. Actual inbox submissions written through the symlink land inside the served tree.

## Impact

Violates the explicit “inbox must never be served” invariant; private submissions can be exposed.

## Fix

- Canonicalize/resolve the existing ancestors of both `www` and `inbox-dir` before comparison (the build `resolve_existing` helper is a model).
- Consider refusing symlinked components under `www` for static serving.
- Tests: inbox path symlinked into www, inbox parent symlinked into www, and www itself a symlink.