You'll notice
Useful2 Signal2
Symlinks inside a command-produced plugin directory are now checked before being installed.
What's wrong with this entry?
Anonymous. No account, no email.
What
When a plugin install produces a directory whose top-level entries are symlinks, each entry is now run through the same untrusted-link check already used elsewhere, so a link pointing at a network location or through an untrusted link is refused instead of being linked into the install.
Details
- The refusal message names the path and the reason.
- Unconditional.
Evidence
points at a network location or through a link that cannot be trusted; refusing to link it
Strings lifted out of the shipped bundle, so the claim above can be checked against them.