Cleanup

internal/tools/fs.go

@@ -2,20 +2,23 @@ package tools
 
 import (
 	"os"
-	"path/filepath"
 )
 
-// IsFile returns whether a file exists and is readable
+// IsFile returns whether a path exists and is a regular file.
+// Symlinks are deliberately rejected to prevent following links to
+// arbitrary files outside the intended location.
 func IsFile(path string) bool {
-	f, err := os.Open(filepath.Clean(path))
-	defer func() { _ = f.Close() }()
-	return err == nil
+	info, err := os.Lstat(path)
+	if err != nil {
+		return false
+	}
+	return info.Mode().IsRegular()
 }
 
 // IsDir returns whether a path is a directory
 func IsDir(path string) bool {
 	info, err := os.Stat(path)
-	if err != nil || os.IsNotExist(err) || !info.IsDir() {
+	if err != nil || !info.IsDir() {
 		return false
 	}