[Help] walkAsync function incorrectly follows symbolic links, leading to a directory traversal vulnerability

[tredcx]

trafficstars

file:src/util.ts

In the current walkAsync function, using 'const stat = await fs.stat(filePath);' causes 'stat.isSymbolicLink()' to always return 'false' because stat returns the target file's metadata. I propose changing it to 'const stat = await fs.lstat(filePath);' to resolve this issue.