I was able to confirm that os.Create() will happily follow symlinks.

Although standard tools like tar will not likely allow you to add two files with the same name to an archive file, it's certainly easy enough to do in code. This means that we need to add an additional check before writing to a destination to make sure that it's not a symlink outside of the destination.

The vulnerab

The streams module currently only supports the double buffer approach, and not the ring buffer approach. The scaffolding for supporting the double buffer approach is in the code, however. This just needs a willing volunteer to implement it.

The streams module was authored by @tSed who may be able to give guidance to a volunteer.