master: CVE-2026-62268 fixes

[ThomasWaldmann]

CVE-2026-62268 — port the extract security fixes to master (borg 2)

Ports the two 1.4-maint security fixes to master. Because borg 2's extract/hardlink architecture differs from 1.4, this is a re-implementation rather than a cherry-pick.

Upstream 1.4-maint commits:

• 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f — refuse unsafe parent paths
• 141888f2fabcd57a300547c2aa63212cb213924d — refuse hardlinks with an unsafe source path

Fix 1/2 — refuse unsafe parent paths (symlinked dir)

A crafted archive with a symlink (evil → /etc) followed by an item below it (evil/passwd) made extract_item() follow the symlink in both the "remove existing file" step and the open()/mkdir()/symlink() step, so it could delete or overwrite files outside the extraction directory.

• New Archive._check_safe_parent() verifies, before any destructive op, that an item's parent chain contains no .. and no symlinked (non-directory) component. Unsafe items are skipped with a warning; verified-safe dirs are cached in Archive.safe_dirs (each dir lstat'd at most once), and make_parent reuses that cache.
• Adds BackupSymlinkParentError (mcode 108) and BackupPathTraversalError (mcode 109).

Differences from 1.4:

• Archived paths are split on / (borg 2 always uses /, even on Windows), not os.sep.
• Symlink targets live in item.target, not item.source.
• The embedded-.. vector is already closed in borg 2 one layer earlier: Item.path is sanitized on encode (assert_sanitized_path) and decode (to_sanitized_path), so a .. path can neither be stored nor read back. The .. branch of _check_safe_parent is therefore defense-in-depth only; the test asserts the item-layer rejection instead.

Fix 2/2 — harden hardlinked-symlink restore

The 1.4 fix validated the attacker-controlled item.source used as the os.link() target and linked with follow_symlinks=False.

borg 2 has no item.source vector: extraction hardlinks are driven by hlid, and the os.link() target is always a path borg itself remembered (HardLinkManager, hlid → path) from a previously extracted item whose path already passed _check_safe_parent(). So there is nothing to validate and nothing raises BackupHardlinkSourceError — the class (mcode 110) is defined only to reserve the number for cross-branch parity with 1.4-maint.

The remaining borg 2 vector is a hardlinked symlink (symlink s → /etc/shadow plus a contentless hardlink h sharing s's hlid). borg 2 already passed follow_symlinks=False, but unconditionally — on a platform where os.link ignores it, that raises NotImplementedError, which backup_io (OSError only) would not catch. This ports the 1.4 os.supports_follow_symlinks guard (fall back to a plain os.link()), plus a comment on why follow_symlinks=False is security-relevant.

Tests

• test_extract_through_symlinked_parent — symlinked-parent vector is refused; out-of-tree victim untouched; symlink restored faithfully.
• test_extract_path_with_embedded_dotdot_rejected_at_item_layer — documents that borg 2 rejects .. paths at the item layer.
• test_extract_deep_tree_ok — the guard / safe_dirs cache doesn't break normal deep-tree extraction.
• test_extract_hardlinked_symlink_does_not_leak_target — h is restored as a hardlink to the symlink inode, not to the external victim's inode. Verified to fail if follow_symlinks=False is removed.

All new tests pass; full local extract_cmd_test.py run: 33 passed, 5 skipped. black clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 93.93939% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.38%. Comparing base (629d440) to head (4f37fdf).
⚠️ Report is 9 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/borg/archive.py	92.30%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9919      +/-   ##
==========================================
+ Coverage   85.27%   85.38%   +0.11%     
==========================================
  Files          93       93              
  Lines       15932    16012      +80     
  Branches     2435     2444       +9     
==========================================
+ Hits        13586    13672      +86     
+ Misses       1636     1632       -4     
+ Partials      710      708       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.