MountableFile directory copy uses a symlink target path as its TAR entry name #12122

hutiefang76 · 2026-10-18T22:55:10Z

hutiefang76
Oct 18, 2026

lMysticl · 2026-10-20T01:48:59Z

lMysticl
Oct 20, 2026

I independently reproduced the path-name loss using the published Testcontainers 2.0.5 artifact on Linux/WSL2, OpenJDK 21.0.12.1, with the fixture compiled for Java 17. The MountableFile.java source in the 2.0.5 tag matches the file at the commit linked in the question.

The in-memory TAR test does not launch a container. Three cases give:

regular file                         -> dest/control.txt                       PASS
link -> target.txt inside copied dir  -> dest/target.txt twice; no dest/link    FAIL
link -> ../outside.txt                -> dest/../outside.txt; no dest/link      FAIL

JUnit reports 3 tests, 2 failures, 0 errors, 0 skipped. The two failures assert that the logical dest/link entry retains the followed file's contents; the regular-file control passes.

The internal-target case is useful additional regression coverage: it demonstrates the alias-name loss even when the target remains inside the copied directory.

The source path explains both outcomes: recursiveTar canonicalizes the child before calculating its relative archive path, and the directory walk passes child.getCanonicalPath() into the recursive call. By the time TarArchiveEntry is constructed, the logical link name has already been lost.

A focused implementation should carry the logical traversal path for entry naming separately from the resolved path used to read contents. Whether following an external target should be allowed is a separate policy question for the project. That can be discussed without changing whether links are stored as symbolic-link TAR entries.

I would keep both link cases and the plain-file control in the regression, and keep a container-copy integration check separate from this TAR-producer test.

Minimal reproduction

Maven fixture with one passing control and two failing link cases

Save the following files in an empty directory. Run on a filesystem that supports symbolic links.

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion><groupId>local.evidence</groupId><artifactId>mountablefile-path-repro</artifactId><version>1.0.0</version>
  <properties><maven.compiler.release>17</maven.compiler.release><project.build.sourceEncoding>UTF-8</project.build.sourceEncoding></properties>
  <dependencies>
    <dependency><groupId>org.testcontainers</groupId><artifactId>testcontainers</artifactId><version>2.0.5</version><scope>test</scope></dependency>
    <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter</artifactId><version>5.13.4</version><scope>test</scope></dependency>
    <dependency><groupId>org.slf4j</groupId><artifactId>slf4j-simple</artifactId><version>1.7.36</version><scope>test</scope></dependency>
  </dependencies>
  <build><plugins>
    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-compiler-plugin</artifactId><version>3.14.0</version></plugin>
    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-surefire-plugin</artifactId><version>3.5.2</version>
      <configuration>
        <argLine>-Djava.io.tmpdir=${project.build.directory}/tmp</argLine>
        <systemPropertyVariables><case.evidence.dir>${project.build.directory}/case-evidence</case.evidence.dir></systemPropertyVariables>
      </configuration>
    </plugin>
  </plugins></build>
</project>

src/test/java/evidence/MountableFilePathTest.java

package evidence;
import org.apache.commons.compress.archivers.tar.TarArchiveEntry;
import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
import org.apache.commons.compress.archivers.tar.TarArchiveOutputStream;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.io.TempDir;
import org.testcontainers.utility.MountableFile;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.List;
import static org.junit.jupiter.api.Assertions.*;
class MountableFilePathTest {
    @TempDir Path root;
    @Test void regularFileRetainsName() throws Exception {
        Path copied = Files.createDirectory(root.resolve("copied"));
        Files.writeString(copied.resolve("control.txt"), "control");
        List<Entry> entries = archive("regular-file", copied);
        assertTrue(entries.stream().anyMatch(e -> e.name.equals("dest/control.txt") && e.content.equals("control")));
    }
    @Test void internalLinkRetainsItsLogicalName() throws Exception {
        Path copied = Files.createDirectory(root.resolve("copied"));
        Files.writeString(copied.resolve("target.txt"), "inside");
        Files.createSymbolicLink(copied.resolve("link"), Path.of("target.txt"));
        List<Entry> entries = archive("internal-link", copied);
        assertTrue(entries.stream().anyMatch(e -> e.name.equals("dest/link") && e.content.equals("inside")),
            () -> "The logical alias dest/link is missing: " + entries);
    }
    @Test void externalLinkRetainsItsLogicalName() throws Exception {
        Path copied = Files.createDirectory(root.resolve("copied"));
        Files.writeString(copied.resolve("control.txt"), "control");
        Files.writeString(root.resolve("outside.txt"), "outside");
        Files.createSymbolicLink(copied.resolve("link"), Path.of("../outside.txt"));
        List<Entry> entries = archive("external-link", copied);
        assertTrue(entries.stream().anyMatch(e -> e.name.equals("dest/link") && e.content.equals("outside")),
            () -> "The logical alias dest/link is missing: " + entries);
        assertFalse(entries.stream().anyMatch(e -> e.name.contains("/../")));
    }
    private List<Entry> archive(String label, Path copied) throws Exception {
        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (TarArchiveOutputStream output = new TarArchiveOutputStream(bytes)) {
            MountableFile.forHostPath(copied).transferTo(output, "dest");
        }
        List<Entry> entries = new ArrayList<>();
        try (TarArchiveInputStream input = new TarArchiveInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
            TarArchiveEntry entry;
            while ((entry = input.getNextEntry()) != null) {
                String content = entry.isDirectory() ? "" : new String(input.readAllBytes(), StandardCharsets.UTF_8);
                entries.add(new Entry(entry.getName(), content, entry.isSymbolicLink()));
            }
        }
        Path proof = Path.of(System.getProperty("case.evidence.dir"));
        Files.createDirectories(proof);
        String joined = String.join(",", entries.stream().map(e -> "{\"name\":\"" + escape(e.name) +
            "\",\"content\":\"" + escape(e.content) + "\",\"symlink\":" + e.symlink + "}").toList());
        String json = "{\"case\":\"" + label + "\",\"java\":\"" + System.getProperty("java.version") +
            "\",\"os\":\"" + System.getProperty("os.name") + "\",\"runtimeJar\":\"" +
            escape(MountableFile.class.getProtectionDomain().getCodeSource().getLocation().toString()) +
            "\",\"entries\":[" + joined + "]}\n";
        Files.writeString(proof.resolve(label + ".json"), json);
        System.out.println("TAR_CASE " + label + ": " + entries);
        return entries;
    }
    private static String escape(String s) {
        return s.replace("\\", "\\\\").replace("\"", "\\\"").replace("\n", "\\n").replace("\r", "\\r");
    }
    private record Entry(String name, String content, boolean symlink) {}
}

Run on Linux/WSL2 (the execution above used JDK 21.0.12.1 and Maven 3.9.9):

mkdir -p target/tmp
mvn -B -ntp test

Expected on Testcontainers 2.0.5: Tests run: 3, Failures: 2, Errors: 0, Skipped: 0. The link-name assertions fail and the regular-file control passes; Maven therefore exits with a failure. The test prints the actual TAR entries and saves them under target/case-evidence/. No Docker daemon is required.

0 replies

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

MountableFile directory copy uses a symlink target path as its TAR entry name #12122

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

MountableFile directory copy uses a symlink target path as its TAR entry name #12122

Uh oh!

hutiefang76 Oct 18, 2026

Replies: 1 comment

Uh oh!

lMysticl Oct 20, 2026

Minimal reproduction

hutiefang76
Oct 18, 2026

lMysticl
Oct 20, 2026