From 7e0ce85449182e5acc221fa508b0398033aac290 Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Sun, 26 Jul 2026 17:58:41 -0700
Subject: [PATCH] Bound standalone launcher symlink resolution

---
 bin/base-bash       |  6 ++++++
 tests/launcher.bats | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/bin/base-bash b/bin/base-bash
index 9883bf3..5ca16fc 100755
--- a/bin/base-bash
+++ b/bin/base-bash
@@ -19,6 +19,7 @@ base_bash_resolve_path() {
     local source_path="${1:-}"
     local link_dir
     local target
+    local link_depth=0
 
     [[ -n "$source_path" ]] || return 1
 
@@ -32,6 +33,11 @@ base_bash_resolve_path() {
     fi
 
     while [[ -L "$source_path" ]]; do
+        link_depth=$((link_depth + 1))
+        if ((link_depth > 40)); then
+            printf 'ERROR: Symlink resolution exceeded 40 links for %s.\n' "$source_path" >&2
+            return 1
+        fi
         link_dir="$(cd -- "$(dirname -- "$source_path")" && pwd -P)" || return 1
         target="$(readlink "$source_path")" || return 1
         if [[ "$target" == /* ]]; then
diff --git a/tests/launcher.bats b/tests/launcher.bats
index bdd6054..163bcb3 100644
--- a/tests/launcher.bats
+++ b/tests/launcher.bats
@@ -91,6 +91,19 @@ SCRIPT
     [[ "$output" == *"did not define main()"* ]]
 }
 
+@test "base-bash bounds symlink resolution" {
+    local first_link="$TEST_TMPDIR/cycle-a"
+    local second_link="$TEST_TMPDIR/cycle-b"
+
+    ln -s "$(basename "$second_link")" "$first_link"
+    ln -s "$(basename "$first_link")" "$second_link"
+
+    bats_run base-bash "$first_link"
+
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"Symlink resolution exceeded 40 links"* ]]
+}
+
 @test "base-bash resolves Homebrew-style libexec layout" {
     local prefix="$TEST_TMPDIR/homebrew-prefix"
     local script="$TEST_TMPDIR/brew-tool"