Preserve relative server symlink targets with a working directory

server.go

@@ -10,6 +10,7 @@ import (
 	"io/fs"
 	"io/ioutil"
 	"os"
+	"path"
 	"path/filepath"
 	"strconv"
 	"sync"
@@ -273,7 +274,8 @@ func handlePacket(s *Server, p orderedRequest) error {
 		err := os.Rename(s.toLocalPath(p.Oldpath), s.toLocalPath(p.Newpath))
 		rpkt = statusFromError(p.ID, err)
 	case *sshFxpSymlinkPacket:
-		err := os.Symlink(s.toLocalPath(p.Targetpath), s.toLocalPath(p.Linkpath))
+		// Relative targets are resolved from the link's directory, not workDir.
+		err := os.Symlink(s.toLocalTarget(p.Targetpath), s.toLocalPath(p.Linkpath))
 		rpkt = statusFromError(p.ID, err)
 	case *sshFxpClosePacket:
 		rpkt = statusFromError(p.ID, s.closeHandle(p.Handle))
@@ -368,6 +370,14 @@ func handlePacket(s *Server, p orderedRequest) error {
 	return nil
 }
 
+func (s *Server) toLocalPath(p string) string {
+	if s.workDir != "" && !path.IsAbs(p) {
+		p = path.Join(s.workDir, p)
+	}
+
+	return s.toLocalTarget(p)
+}
+
 // Serve serves SFTP connections until the streams stop or the SFTP subsystem
 // is stopped. It returns nil if the server exits cleanly.
 func (svr *Server) Serve() error {

server_nowindows_test.go

@@ -4,9 +4,68 @@
 package sftp
 
 import (
+	"io"
+	"os"
+	"path/filepath"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
+func TestServerSymlinkTargets(t *testing.T) {
+	for _, withWorkDir := range []bool{false, true} {
+		name := "without working directory"
+		if withWorkDir {
+			name = "with working directory"
+		}
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.Mkdir(filepath.Join(dir, "sub"), 0o755))
+			require.NoError(t, os.WriteFile(filepath.Join(dir, "sub", "file"), []byte("subdirectory"), 0o600))
+			require.NoError(t, os.WriteFile(filepath.Join(dir, "file"), []byte("parent"), 0o600))
+
+			var options []ServerOption
+			if withWorkDir {
+				options = append(options, WithServerWorkingDirectory(dir))
+			}
+			client, server := clientServerPair(t, options...)
+			defer client.Close()
+			defer server.Close()
+
+			for _, tt := range []struct {
+				name, target, contents string
+			}{
+				{"relative", "file", "subdirectory"},
+				{"parent", "../file", "parent"},
+				{"absolute", filepath.ToSlash(filepath.Join(dir, "file")), "parent"},
+				{"dangling", "missing", ""},
+			} {
+				t.Run(tt.name, func(t *testing.T) {
+					link := "sub/" + tt.name
+					if !withWorkDir {
+						link = filepath.ToSlash(filepath.Join(dir, link))
+					}
+					require.NoError(t, client.Symlink(tt.target, link))
+					target, err := client.ReadLink(link)
+					require.NoError(t, err)
+					require.Equal(t, tt.target, target)
+					if tt.name == "dangling" {
+						_, err := client.Stat(link)
+						require.True(t, os.IsNotExist(err), "stat dangling link: %v", err)
+						return
+					}
+					file, err := client.Open(link)
+					require.NoError(t, err)
+					defer file.Close()
+					contents, err := io.ReadAll(file)
+					require.NoError(t, err)
+					require.Equal(t, tt.contents, string(contents))
+				})
+			}
+		})
+	}
+}
+
 func TestServer_toLocalPath(t *testing.T) {
 	tests := []struct {
 		name        string

server_plan9.go

@@ -5,11 +5,7 @@ import (
 	"path/filepath"
 )
 
-func (s *Server) toLocalPath(p string) string {
-	if s.workDir != "" && !path.IsAbs(p) {
-		p = path.Join(s.workDir, p)
-	}
-
+func (s *Server) toLocalTarget(p string) string {
 	lp := filepath.FromSlash(p)
 
 	if path.IsAbs(p) {

server_unix.go

@@ -3,14 +3,6 @@
 
 package sftp
 
-import (
-	"path"
-)
-
-func (s *Server) toLocalPath(p string) string {
-	if s.workDir != "" && !path.IsAbs(p) {
-		p = path.Join(s.workDir, p)
-	}
-
+func (s *Server) toLocalTarget(p string) string {
 	return p
 }

server_windows.go

@@ -12,11 +12,7 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-func (s *Server) toLocalPath(p string) string {
-	if s.workDir != "" && !path.IsAbs(p) {
-		p = path.Join(s.workDir, p)
-	}
-
+func (s *Server) toLocalTarget(p string) string {
 	lp := filepath.FromSlash(p)
 
 	if path.IsAbs(p) { // starts with '/'