Fix trailing-slash behavior with O_NOFOLLOW. (#420)

When a path has a trailing slash, the path component just before
the trailing slash is not considered a final path component for the
purposes of the OS `O_NOFOLLOW` flag. Fix cap-primitives to avoid
re-appending a trailing slash when resolving paths with a trailing
slash so that it doesn't inadvertently disable `O_NOFOLLOW`.

This fixes GHSA-hp8f-xmx4-4qrg.

Author: sunfishcode

tests/fs_additional.rs

@@ -1509,3 +1509,99 @@ fn trailing_slash_symlink_more() {
         );
     }
 }
+
+/// Test interactions between symlinks and trailing slashes.
+#[test]
+fn trailing_slash_symlink() {
+    let tmpdir = tmpdir();
+
+    check!(tmpdir.create_dir("sandbox"));
+    check!(symlink_dir("../outside", &tmpdir, "sandbox/hidden"));
+    check!(symlink_dir("hidden/", &tmpdir, "sandbox/indirect"));
+
+    let sandbox = check!(tmpdir.open_dir("sandbox"));
+
+    for path in ["hidden", "hidden/", "indirect", "indirect/"] {
+        error!(
+            sandbox.open_dir(path),
+            "a path led outside of the filesystem"
+        );
+        error!(
+            sandbox.read_dir(path),
+            "a path led outside of the filesystem"
+        );
+        error!(
+            sandbox.canonicalize(path),
+            "a path led outside of the filesystem"
+        );
+    }
+}
+
+/// Similar to `trailing_slash_symlink`, but populates the test directory
+/// outside the sandbox, so it can cover more cases.
+#[test]
+fn trailing_slash_symlink_more() {
+    let tmpdir = tempfile::tempdir().unwrap();
+
+    check!(std::fs::create_dir(tmpdir.path().join("sandbox")));
+    #[cfg(unix)]
+    {
+        check!(std::os::unix::fs::symlink(
+            "../outside",
+            tmpdir.path().join("sandbox/hidden")
+        ));
+        check!(std::os::unix::fs::symlink(
+            "hidden/",
+            tmpdir.path().join("sandbox/indirect")
+        ));
+        check!(std::os::unix::fs::symlink(
+            "/.",
+            tmpdir.path().join("sandbox/root_link")
+        ));
+    }
+    #[cfg(windows)]
+    {
+        check!(std::os::windows::fs::symlink_dir(
+            "../outside",
+            tmpdir.path().join("sandbox/hidden")
+        ));
+        check!(std::os::windows::fs::symlink_dir(
+            "hidden/",
+            tmpdir.path().join("sandbox/indirect")
+        ));
+        check!(std::os::windows::fs::symlink_dir(
+            "/.",
+            tmpdir.path().join("sandbox/root_link")
+        ));
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        compile_error!("not implemented yet");
+    }
+
+    let tmpdir = check!(Dir::open_ambient_dir(tmpdir.path(), ambient_authority()));
+
+    let sandbox = check!(tmpdir.open_dir("sandbox"));
+
+    for path in [
+        "hidden",
+        "hidden/",
+        "indirect",
+        "indirect/",
+        "root_link",
+        "root_link/",
+    ] {
+        error!(
+            sandbox.open_dir(path),
+            "a path led outside of the filesystem"
+        );
+        error!(
+            sandbox.read_dir(path),
+            "a path led outside of the filesystem"
+        );
+        error!(
+            sandbox.canonicalize(path),
+            "a path led outside of the filesystem"
+        );
+    }
+}