feat: add allowSymlinks option to File transport for symlink handling #2595
+165
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull request overview
This PR adds a new allowSymlinks option to the File transport to control whether symbolic links should be followed when writing logs. When set to false, the transport uses the O_NOFOLLOW flag to prevent writes to symlinks, enhancing security by preventing symlink-based attacks.
Key Changes:
- Added
allowSymlinksoption (defaults totruefor backward compatibility) - Modified stream creation to use
O_NOFOLLOWflag when symlinks are disallowed - Added comprehensive test coverage for both enabled and disabled symlink handling
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| lib/winston/transports/file.js | Adds allowSymlinks option initialization and implements O_NOFOLLOW flag logic in _createStream method |
| test/unit/winston/transports/file.test.js | Adds new test suite "Symlink Option" with tests for both allowSymlinks: false and default behavior |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
indexzero
approved these changes
Dec 9, 2025
Member
indexzero
left a comment
There was a problem hiding this comment.
👍 once the workflow runs pass
Author
|
@indexzero I've pushed additional tests to improve coverage and potentially resolve the pipeline failure |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a new option
allowSymlinksto theFiletransport to give users control over whether symbolic links should be followed when writing logs.