<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. -->
### PR Summary
Fix: [[MSRC 118865] FileSystemProvider - Path traversal via PSRP filenames in Copy-Item -FromSession](https://dev.azure.com/msazure/One/_workitems/edit/38762093/)
`Copy-Item -FromSession` builds local destination paths from item, directory, and alternate-data-stream names returned by the remote PSRP endpoint without validating them. A malicious or compromised endpoint can return a name containing "".."", a path separator, a drive/root, or "":"" to write files outside the user-selected -Destination (for example the Startup folder or a PowerShell profile), yielding arbitrary file write and code execution in the client user's context
This pull request prevents path traversal attacks for `Copy-Item -FromSession`. It introduces validation to ensure that remote-supplied file, directory, and alternate data stream names cannot be used to escape intended directories.
**Security improvements for remote copy operations:**
* Added a new method `CanRemoteNameCausePathTraversal` in `FileSystemProvider.cs` to detect potentially dangerous remote-supplied names that could enable path traversal.
* Updated `CopyDirectoryFromRemoteSession` and `CopyFileFromRemoteSession` methods to validate remote directory, file, and alternate data stream names using the new method, and to throw descriptive errors if an unsafe name is detected.
* Added new error messages to `FileSystemProviderStrings.resx` for directory, file, and alternate data stream path traversal attempts.
**Testing enhancements:**
* Introduced direct tests for `CanRemoteNameCausePathTraversal` with a variety of safe and unsafe names in `Copy-Item.Tests.ps1`.
* Refactored remote session test setup. They haven't been running for PS7. This PR used a helper function and updated test tags to ensure tests run in the correct environments.
* Added verbose TCP test logic
* Cleaned up output, removed source IP address
* Consolidated detailed output logic into ProcessConnectionByTCPPort()
* Updated existing tests with -Quiet switch
* Improved output formatting, changed logic to match
* Error handling and logic improvements
* Updated tests to match new output
* Updated logic, tcp tests now run once by default
* Moved TcpConnectionTestResult enum into TcpTestStatus class
* Removed unnecessary whitespace
* Wrapped TcpClient() in Using statement
* Appended missing period on comments
* Change TcpTestStatus to TcpPortStatus for better clarity
* Set default count back to 4
* Move stopwatch reset into finally block
* Change TcpConnectionTestResult.New to TcpConnectionTestResult.None
* Formatting fixes
* Increase column size for Result output
* Update logic for -quiet option
* Change "TestNum" property to "Id"
* Change Destination and DestinationAddress to Target and TargetAddress in TcpPortStatus
* Implement new form of using declaration
* Fix indentation
* Update output, improve logic and update tests
* Add CancellationToken to allow cancel before timeout
* Assign testResult.Connected to client.Connected
* Move TcpPortStatus object creation to after connection test
* Remove delay from final connection test in loop
* Move Count logic from ProcessConnectionByTCPPort into own function
* Fix small formatting error
* Add handling for TaskCanceledException
* Remove redundant CancellationToken getter
* Clean up handling of SocketException
* Increase readability of final loop check
* Remove unnecessary TimeSpan invocation
* Rename cancellationTokenSource to match convention
* Move SetCountForTcpTest() into BeginProcessing()
* Added nameof to Count check
* Removed explicit type declaration for TcpClient
* Move delay and timeout evaluation out of the cycle
* Remove redundant CancellationTokenSource
* Initialize detailed SwitchParameter
* Add check for Detailed parameter
* Remove redundant tests for non-detailed output
* Add return after first boolean output
* Update tests with new detailed parameter set
---------
Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>
* Add `-Environment` parameter to `Start-Process`
* address codefactor
* fix test for Windows
* handle case where value is $null to remove env var
* change variables to make it more clear what the test is doing
* Add CI for win-arm64
* Add common function to test for windows arm64
* Update because string where items need investigation
---------
Co-authored-by: Aditya Patwardhan <adityap@microsoft.com>
Patrick Meinecke