Refuse symlinks in packages
A media package could contain a symlink, pointing to a system file. This is a security hazard.
We should not let it happen.
My personal opinion is that we should just refuse all symlinks in media packages (and maybe in all packages?). When installing a file from a package, if it is a symlink, we should just treat it as an error and move to the next file.
Another solution would be to verify that the symlink doesn't point outside of the media packages space. Ensuring that it doesn't start with /
or ../
should be enough.
However, I can't see the value in having a media be a symlink to another media, so I'm inclined to just say no to symlinks entirely, and eventually revisit if we ever find a use-case.