security: harden recursive file operations

chfs-ng/internal/storage/storage_test.go

@@ -7,6 +7,29 @@ import (
 	"time"
 )
 
+func TestLocalRemoveSymlinkDoesNotDeleteTarget(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	target := filepath.Join(outside, "secret.txt")
+	if err := os.WriteFile(target, []byte("keep"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(root, "link")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	store := Local{Root: root}
+	if err := store.Remove("link"); err != nil {
+		t.Fatalf("remove symlink: %v", err)
+	}
+	if _, err := os.Stat(target); err != nil {
+		t.Fatalf("symlink removal must not delete target: %v", err)
+	}
+	if _, err := os.Lstat(link); !os.IsNotExist(err) {
+		t.Fatalf("symlink should be removed, got %v", err)
+	}
+}
+
 func TestLocalRejectsSymlinkEscapeAndAllowsNestedCreate(t *testing.T) {
 	root := t.TempDir()
 	outside := t.TempDir()