fix(R-1187 b): restored links point only downward — no absolute target, no '..', no link on the way

Third automated security review finding, red-proved.

controller/internal/appexport/r1187_abdfg_test.go

@@ -248,3 +248,29 @@ func TestR1187b_NoLinkThroughALinkedParent(t *testing.T) {
 		t.Fatalf("the refused link must be listed, got %v", refused)
 	}
 }
+
+// (b), the security review's third case: a link TARGET that passes through a link already in the folder („evil" → an
+// outside folder, then „x" → „evil/y") reads as inside by its text and really points outside. Restored links may only
+// point DOWNWARD to real folders: no absolute target, no „..", no link on the way. RED-PROOF: the text check created „x".
+func TestR1187b_NoLinkTargetThroughALink(t *testing.T) {
+	outside := t.TempDir()
+	dest := t.TempDir()
+	os.Symlink(outside, filepath.Join(dest, "evil"))
+	tarPath := filepath.Join(t.TempDir(), "d.tar")
+	f, _ := os.Create(tarPath)
+	tw := tar.NewWriter(f)
+	tw.WriteHeader(&tar.Header{Name: "x", Typeflag: tar.TypeSymlink, Linkname: "evil/y"})
+	tw.WriteHeader(&tar.Header{Name: "up", Typeflag: tar.TypeSymlink, Linkname: "sub/../sub"})
+	tw.Close()
+	f.Close()
+	old := lchownFn
+	lchownFn = func(*os.Root, string, int, int) error { return nil }
+	defer func() { lchownFn = old }()
+	refused, _ := extractTar(tarPath, dest)
+	if _, err := os.Lstat(filepath.Join(dest, "x")); err == nil {
+		t.Fatal("a link whose target passes through an outside-pointing link was created")
+	}
+	if strings.Join(refused, ",") != "x,up" {
+		t.Fatalf("both links must be refused and listed, got %v", refused)
+	}
+}