* kubectl cp now safely allows unpacking of symlinks that may point outside the destination directory ([#82384](https://github.com/kubernetes/kubernetes/pull/82384), [@tallclair](https://github.com/tallclair))

* openapi now advertises correctly supported patch types for custom resources ([#81515](https://github.com/kubernetes/kubernetes/pull/81515), [@liggitt](https://github.com/liggitt))
* kubectl cp now safely allows unpacking of symlinks that may point outside the destination directory ([#82384](https://github.com/kubernetes/kubernetes/pull/82384), [@tallclair](https://github.com/tallclair))

package cmd

// Options for readDir function call
type readDirOpts struct {
	// The maximum number of entries to return
	count int
	// Follow directory symlink
	followDirSymlink bool
}

// Return all the entries at the directory dirPath.
func readDir(dirPath string) (entries []string, err error) {
	return readDirWithOpts(dirPath, readDirOpts{count: -1})
}

                  .scanResources())
          .hasSize(1);
    } finally {
      jarFile.delete();
    }
  }

  @AndroidIncompatible // Path (for symlink creation)

  public void testScanDirectory_symlinkCycle() throws IOException {
    if (isWindows()) {
      return; // TODO: b/136041958 - Can we detect cycles under Windows?
    }

)

// IsLikelyMountPoint determines if a directory is a mountpoint.
func IsLikelyMountPoint(path string) bool {
	s1, err := os.Lstat(path)
	if err != nil {
		return false
	}

	// A symlink can never be a mount point
	if s1.Mode()&os.ModeSymlink != 0 {
		return false
	}

	s2, err := os.Lstat(filepath.Dir(strings.TrimSuffix(path, "/")))
	if err != nil {
		return false
	}

        assertNotNull(result);
        assertTrue(result.normalize().startsWith(tempDir.normalize()), "Path must stay within base directory: " + result);
    }

    // --- symlink traversal prevention tests ---

    @Test
    public void test_exportDocument_symlinkIntermediateDir() throws Exception {
        final Path outsideDir = Files.createTempDirectory("outside");
        try {

            Files.createDirectories(filePath.getParent());
            final Path realParent = filePath.getParent().toRealPath();
            if (!realParent.startsWith(realBase)) {
                logger.warn("Symlink traversal detected: url={}, realParent={}, realBase={}", url, realParent, realBase);
                return;
            }
            final byte[] bytes = content.getBytes(StandardCharsets.UTF_8);

	stopFn := globalSftpMetrics.log(r, f.AccessKey())
	defer stopFn(0, err)

	clnt, err := f.getMinIOClient()
	if err != nil {
		return err
	}

	switch r.Method {
	case "Setstat", "Rename", "Link", "Symlink":
		return sftp.ErrSSHFxOpUnsupported

	case "Rmdir":
		bucket, prefix := path2BucketObject(r.Filepath)
		if bucket == "" {
			return errors.New("deleting all buckets not allowed")
		}

   * </ul>
   *
   * <p>These heuristics do not always match the behavior of the filesystem. In particular, consider
   * the path {@code a/../b}, which {@code simplifyPath} will change to {@code b}. If {@code a} is a
   * symlink to {@code x}, {@code a/../b} may refer to a sibling of {@code x}, rather than the
   * sibling of {@code a} referred to by {@code b}.
   *
   * @since 11.0
   */
  public static String simplifyPath(String pathname) {

* CRI now defines mounting behavior. If the host path doesn't exist, the runtime should return an error. If the host path is a symlink, the runtime should follow the symlink and mount the real destination to the container. ([#61460](https://github.com/kubernetes/kubernetes/pull/61460), [@feiskyer](https://github.com/feiskyer))

### SIG OpenStack