Improve CAB extraction path handling - #28009
Merged
Dongbo Wang (daxian-dbw) merged 1 commit intoSep 11, 2026
Merged
Conversation
Anam Navied (anamnavi)
requested review from
a team,
Aditya Patwardhan (adityapatwardhan) and
Dongbo Wang (daxian-dbw)
as code owners
September 11, 2026 17:46
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical CAB extraction safety issues remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Improves CAB extraction path safety and makes a Debug-Runspace test less timing-sensitive.
Changes:
- Adds CAB path validation and extraction error handling.
- Increases the Debug-Runspace event wait timeout.
File summaries
| File | Review summary |
|---|---|
test/powershell/Modules/Microsoft.PowerShell.Utility/Debug-Runspace.Tests.ps1 |
Extends the asynchronous wait timeout. |
src/System.Management.Automation/help/CabinetNativeApi.cs |
Critical issues: FdiOpen exceptions can escape the callback (3 votes), and reparse points can bypass path containment (2 votes). Nit: add regression coverage for malicious and valid CAB paths (1 vote). |
Review details
Suppressed comments (1)
src/System.Management.Automation/help/CabinetNativeApi.cs:398
- These new security checks are not covered by a regression test. The existing Update-Help tests exercise trusted CABs but do not cover rooted paths,
..traversal, colon/ADS names, or directory-prefix collisions, so a future change could reintroduce extraction outside the destination without failing CI. Add a Windows CAB fixture/test that asserts malicious entries are rejected while valid nested paths still extract.
// Ensure resolved path starts with the canonical help directory.
// OrdinalIgnoreCase is intentional: NTFS on Windows is case-insensitive, so two paths that
// differ only in case refer to the same file and must be treated as equivalent here.
if (!resolvedPath.StartsWith(canonicalHelpDir, StringComparison.OrdinalIgnoreCase))
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Anam Navied (anamnavi)
added
the
CL-Engine
Dongbo Wang (daxian-dbw)
approved these changes
Sep 11, 2026
Dongbo Wang (daxian-dbw)
merged commit Sep 11, 2026
9f7b306
into
PowerShell:master
36 of 41 checks passed
| // The trailing separator is needed to prevent false positive matches where a directory | ||
| // name is a prefix of another (e.g., "/path/help" matching "/path/help-backup/file.txt") | ||
| string canonicalHelpDir = Path.GetFullPath(helpDirectory); | ||
| if (!canonicalHelpDir.EndsWith(Path.DirectorySeparatorChar.ToString())) |
Collaborator
There was a problem hiding this comment.
We have no need to use ToString().
Also now there is Path.EndsInDirectorySeparator() method.
Suggested change
| if (!canonicalHelpDir.EndsWith(Path.DirectorySeparatorChar.ToString())) | |
| if (!Path.EndsInDirectorySeparator(canonicalHelpDir)) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
This pull request improves path handling during CAB file extraction in CabinetNativeApi and enhances error handling around extraction operations. It ensures extracted files are resolved relative to the intended help directory before files or directories are created. The change also includes a test update to improve reliability in Debug-Runspace tests.
PR Context
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright header