fix: reject profile diagnostic symlink ancestors

cmd/proxyctl/maintenance_test.go

@@ -105,6 +105,36 @@ func TestDoctorReturnsFailureWhenAnyCheckFails(t *testing.T) {
 	}
 }
 
+func TestDoctorProfileValidityRejectsSymlinkWithoutValidatingTarget(t *testing.T) {
+	victim := filepath.Join(t.TempDir(), "victim.json")
+	const content = "target content that is deliberately not JSON"
+	if err := os.WriteFile(victim, []byte(content), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	directory := t.TempDir()
+	path := filepath.Join(directory, "profiles.json")
+	if err := os.Symlink(victim, path); err != nil {
+		t.Fatal(err)
+	}
+
+	var output bytes.Buffer
+	err := runMaintenanceCommand([]string{"doctor"}, strings.NewReader(""), &output, profile.NewFileStore(path), nil, nil, nil, nil)
+	text := output.String()
+	if err == nil || !strings.Contains(text, "[FAIL] Profile validity") {
+		t.Fatalf("doctor symlink result err=%v output=%q", err, text)
+	}
+	if strings.Contains(text, "parse Profile configuration") || strings.Contains(text, content) {
+		t.Fatalf("doctor read or validated symlink target: %q", text)
+	}
+	got, readErr := os.ReadFile(victim)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if string(got) != content {
+		t.Fatalf("doctor changed victim content to %q", got)
+	}
+}
+
 func TestDoctorStorageAuthorityRejectsSymlinkedPathsWithoutTouchingVictim(t *testing.T) {
 	for _, test := range []struct {
 		name string