Fixes the symlink handling issue in the authorized_key module (#760) (#762)

- Addresses CVE-2026-11837
- Fixes #759

Signed-off-by: Hideki Saito <saito@fgrep.org>

tests/integration/targets/authorized_key/tasks/check_symlink.yml

@@ -0,0 +1,22 @@
+---
+#
+# Check: keysfile is symlink and follow=false
+#
+- name: Try to add key with keysfile as symlink
+  ansible.posix.authorized_key:
+    user: testuser
+    key: "{{ rsa_key_basic }}"
+    state: present
+    manage_dir: false
+    follow: false
+
+- name: Assert target file ownership unchanged
+  ansible.builtin.stat:
+    path: /tmp/symlink_test_target/target_file
+  register: target_file_stat
+
+- name: Verify target file is still owned by root
+  ansible.builtin.assert:
+    that:
+      - target_file_stat.stat.uid == 0
+...

tests/integration/targets/authorized_key/tasks/check_symlink_cleanup.yml

@@ -0,0 +1,12 @@
+---
+- name: Remove testuser
+  ansible.builtin.user:
+    name: testuser
+    state: absent
+    remove: true
+
+- name: Remove symlink target directory
+  ansible.builtin.file:
+    path: /tmp/symlink_test_target
+    state: absent
+...

tests/integration/targets/authorized_key/tasks/check_symlink_setup.yml

@@ -0,0 +1,38 @@
+---
+- name: Create testuser for symlink tests
+  ansible.builtin.user:
+    name: testuser
+    create_home: true
+  register: testuser_result
+
+- name: Create symlink target directory
+  ansible.builtin.file:
+    path: /tmp/symlink_test_target
+    state: directory
+    owner: root
+    mode: '0700'
+
+- name: Create a target file owned by root
+  ansible.builtin.copy:
+    dest: /tmp/symlink_test_target/target_file
+    content: "sensitive data"
+    owner: root
+    mode: '0600'
+
+- name: Remove .ssh directory if exists
+  ansible.builtin.file:
+    path: "{{ testuser_result.home }}/.ssh"
+    state: absent
+
+- name: Create .ssh directory
+  ansible.builtin.file:
+    path: "{{ testuser_result.home }}/.ssh"
+    state: directory
+    mode: '0700'
+
+- name: Create symlink from authorized_keys to target file
+  ansible.builtin.file:
+    src: /tmp/symlink_test_target/target_file
+    dest: "{{ testuser_result.home }}/.ssh/authorized_keys"
+    state: link
+...

tests/integration/targets/authorized_key/tasks/main.yml

@@ -17,7 +17,7 @@
 # You should have received a copy of the GNU General Public License
 # along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 
-- name: Setup testing environment
+- name: Setup for testing environment
   ansible.builtin.import_tasks: setup_steps.yml
 
 - name: Test for multiple keys handling
@@ -37,3 +37,12 @@
 
 - name: Test for permission denied files
   ansible.builtin.import_tasks: check_permissions.yml
+
+- name: CVE-2026-11837 Setup for symlink tests
+  ansible.builtin.import_tasks: check_symlink_setup.yml
+
+- name: CVE-2026-11837 Test for symlink tests
+  ansible.builtin.import_tasks: check_symlink.yml
+
+- name: CVE-2026-11837 Cleanup symlink test
+  ansible.builtin.import_tasks: check_symlink_cleanup.yml