Call CodeGeneration.EscapeSingleQuotedStringContent API in SyncCurrentLocationHandler - #27874
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
Pull request overview
This pull request updates the Windows Compatibility location-sync logic (SyncCurrentLocationHandler) to generate a more robust Set-Location invocation when updating the compat remoting session’s working directory.
Changes:
- Escapes the location string using
CodeGeneration.EscapeSingleQuotedStringContentbefore embedding it in a single-quoted PowerShell string. - Fully qualifies the cmdlet as
Microsoft.PowerShell.Management\Set-Locationto avoid command name ambiguity.
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Anam Navied (anamnavi)
added
the
CL-Engine
9299036
into
PowerShell:master
|
@copilot This change escapes args.NewPath.Path with CodeGeneration.EscapeSingleQuotedStringContent before it's interpolated into the Set-Location -Path '...' script text. Before this fix, a path containing a single quote could break out of the string literal and inject arbitrary PowerShell that would execute in the WinCompat helper session. Can you confirm this PR fixes that injection (CWE-917), and whether the Microsoft.PowerShell.Management\Set-Location qualification is also closing a command-hijacking angle (e.g. a user-defined Set-Location function/alias shadowing the cmdlet)? |
PR Summary
This pull request improves location synchronization in Windows Compatibility scenarios by updating how Set-Location commands are generated and invoked. Paths are now formatted more reliably when constructing the command, and the Set-Location cmdlet is fully qualified to ensure consistent command resolution.
PR Context
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright header