From 3c3133d3399257492347f535d8d191680803b25d Mon Sep 17 00:00:00 2001
From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Sun, 23 Aug 2026 17:14:06 +0530
Subject: [PATCH] Defense in depth use O_NOFOLLOW when opening regular files

---
 kitty/dnd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kitty/dnd.c b/kitty/dnd.c
index 8743d2888..4d91dfd25 100644
--- a/kitty/dnd.c
+++ b/kitty/dnd.c
@@ -952,7 +952,7 @@ drop_send_file_chunks(Window *w) {
 static bool
 drop_send_file_data(Window *w, const char *path) {
     drop_close_file_fd(w);
-    int fd = safe_open(path, O_RDONLY | O_CLOEXEC | O_NONBLOCK, 0);
+    int fd = safe_open(path, O_RDONLY | O_CLOEXEC | O_NONBLOCK | O_NOFOLLOW, 0);
     if (fd < 0) {
         switch (errno) {
             case ENOENT: