chore: extensive checking and error handling for EvalSymlinks

Author: ritikrajdev

copy_dir.go

@@ -17,6 +17,26 @@ func mode(mode, umask os.FileMode) os.FileMode {
 	return mode & ^umask
 }
 
+func safeEvalSymlinks(path string) (string, error) {
+	resolved, err := filepath.EvalSymlinks(path)
+	if err == nil || runtime.GOOS != "windows" {
+		return resolved, err
+	}
+
+	// On Windows with Go 1.23+, EvalSymlinks may not resolve junctions
+	fi, statErr := os.Lstat(path)
+	if statErr != nil {
+		return "", err // fallback to original error
+	}
+
+	if fi.Mode()&os.ModeSymlink != 0 || fi.Mode()&os.ModeIrregular != 0 {
+		// Accept it as a reparse point (symlink or junction)
+		return path, nil
+	}
+
+	return "", err
+}
+
 // copyDir copies the src directory contents into dst. Both directories
 // should already exist.
 //
@@ -25,13 +45,9 @@ func copyDir(ctx context.Context, dst string, src string, ignoreDot bool, disabl
 	// We can safely evaluate the symlinks here, even if disabled, because they
 	// will be checked before actual use in walkFn and copyFile
 	var err error
-	resolved, err := filepath.EvalSymlinks(src)
+	resolved, err := safeEvalSymlinks(src)
 	if err != nil {
-		if runtime.GOOS == "windows" {
-			resolved = src
-		} else {
-			return err
-		}
+		return err
 	}
 
 	// Check if the resolved path tries to escape upward from the original