{"version":"1.0.120","anchor":"symlink-resolution-in-permission-checks","canonical_anchor":"symlink-resolution-in-permission-checks","heading":"Symlink Resolution in Permission Checks","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.120\/e\/symlink-resolution-in-permission-checks","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.120","markdown":"### Symlink Resolution in Permission Checks\n\n**What:** File permission checks now resolve symlinks and verify that BOTH the symlink path AND its target are allowed, preventing permission bypass attacks via symlinks.\n\n**How it works:**\n\n- When checking read\/edit permissions for `\/home\/user\/project\/link`, Claude Code now resolves it to its real path (e.g., `\/etc\/passwd`)\n- Both paths are checked against permission rules\n- Access is denied if EITHER path is restricted\n\n**Details:**\n\n- New function `CD1()` at line 339792 returns array of [original_path, resolved_path]\n- Helper function `fW()` at line 339783 performs symlink resolution using `realpathSync()`\n- Integrated into read permissions at `o11()` at line 439057\n- Integrated into edit permissions at `dd()` at line 439126\n- Integrated into working directory checks at `QE()` at line 438915\n- Gracefully handles non-existent files and resolution errors\n\n**Evidence**\n\n`CD1()` at line 339792, `fW()` at line 339783, read permission integration at lines 439066-439084, edit permission integration at lines 439133-439154"}