Harden OS.rmdir() against symlink traversal during forced decode

[Copilot]

OS.rmdir() used File.isDirectory() which follows symlinks, causing apktool d --force to recurse into symlink targets and delete files outside the intended output directory — a path traversal via symlink vulnerability.

Changes

• brut.j.util/OS.java: Added Files.isSymbolicLink() guards (NIO, does not follow symlinks) in two places within rmdir():
  • Top-level: if the argument itself is a symlink, delete only the symlink and return
  • Recursion loop: if a child entry is a symlink (even to a directory), delete only the symlink — never recurse into it

// Before: File.isDirectory() follows symlinks
if (file.isDirectory()) {
    rmdir(file);  // recurses into symlink target!
}

// After: symlinks are treated as opaque files regardless of target type
if (!Files.isSymbolicLink(file.toPath()) && file.isDirectory()) {
    rmdir(file);
} else {
    rmfile(file);  // deletes the symlink itself
}

• brut.j.util/build.gradle.kts: Added testImplementation(libs.junit) to enable unit tests in this module
• brut.j.util/OSTest.java: Two new unit tests covering the symlink cases — symlink as the root argument and symlink nested inside a directory being deleted

• Fixes Harden deletion of symlinks during build #4183

[IgorEisberg]

@copilot This is a very elementary change, there's no need for a whole test for that in the brut.j.util module that otherwise has no tests. Otherwise the change is fine as long as the user doesn't have any intentional/non-malicious use of symlinks in his project.

[iBotPeaches]

@copilot This is a very elementary change, there's no need for a whole test for that in the brut.j.util module that otherwise has no tests. Otherwise the change is fine as long as the user doesn't have any intentional/non-malicious use of symlinks in his project.

[Copilot]

@copilot This is a very elementary change, there's no need for a whole test for that in the brut.j.util module that otherwise has no tests. Otherwise the change is fine as long as the user doesn't h...

Removed the test file and the testImplementation dependency from build.gradle.kts in commit Remove test file and test dependency from brut.j.util.

@copilot This is a very elementary change, there's no need for a whole test for that in the brut.j.util module that otherwise has no tests. Otherwise the change is fine as long as the user doesn't hav...

Removed the test file and the testImplementation dependency from build.gradle.kts in commit Remove test file and test dependency from brut.j.util.