Do not copy directory symlinks recursively.

[rqu]

When copying files (running the cp task, or moving files from/to sandbox), symlinks to directories are followed. The target of the symlink is copied. The resolution and copying happens outside of the sandbox.

By creating a directory containing a nonempty file and a few symlinks to the directory itself, this can be abused for a DoS attack against the worker, filling all allowed space on the disk containing the working directory. After the copying fails due to full disk, the files are not cleaned up.

Moreover, if a compiler could be persuaded to create a symlink, some directories outside of the sandbox could be copied into the execution sandbox, making it readable to the evaluated program.

Fixed this by replacing is_directory(const path&) (equivalent to is_directory(status(const path&))) with is_directory(symlink_status(const path&)). symlink_status is identical to status, except that if the path refers to a symbolic link, it obtains information about the link itself, not the target.