curl file writing susceptible to symlink attacks