tests: add test for unsafe symlinks

Symlinks pointing outside of copied directory should be denied in both
filecopy modes

QubesOS/qubes-issues#8332

(cherry picked from commit 0aa1382)

qubes/tests/integ/vm_qrexec_gui.py

@@ -827,6 +827,35 @@ def test_140_qrexec_filecopy_unsafe_name(self):
         except subprocess.CalledProcessError:
             self.fail('source file got removed')
 
+    def test_141_qrexec_filecopy_unsafe_symlink(self):
+        self.loop.run_until_complete(asyncio.gather(
+            self.testvm1.start(),
+            self.testvm2.start()))
+
+        # symlinks are not allowed in either mode
+        name = "test"
+        self.loop.run_until_complete(self.testvm1.run_for_stdio(
+            f"ln -s /etc/passwd /tmp/{name}"))
+        self.loop.run_until_complete(self.testvm1.run_for_stdio(
+            f"ln -s ../etc/passwd /tmp/{name}2"))
+        with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2):
+            with self.assertRaises(subprocess.CalledProcessError):
+                self.loop.run_until_complete(
+                    self.testvm1.run_for_stdio(
+                        f"qvm-copy-to-vm {self.testvm2!s} /tmp/{name}"))
+            with self.assertRaises(subprocess.CalledProcessError):
+                self.loop.run_until_complete(
+                    self.testvm1.run_for_stdio(
+                        f"qvm-copy-to-vm {self.testvm2!s} /tmp/{name}2"))
+
+        try:
+            self.loop.run_until_complete(self.testvm2.run_for_stdio(
+                f"! test -e /home/user/QubesIncoming/{self.testvm1!s}/{name}"))
+            self.loop.run_until_complete(self.testvm2.run_for_stdio(
+                f"! test -e /home/user/QubesIncoming/{self.testvm1!s}/{name}2"))
+        except subprocess.CalledProcessError:
+            self.fail('file with "unsafe" symlink was copied')
+
     def test_200_timezone(self):
         """Test whether timezone setting is properly propagated to the VM"""
         if "whonix" in self.template: