mirror of
https://github.com/aphrody-labs/PowerShell.git
synced 2026-10-15 06:09:09 +00:00
Patrick Meinecke
2a70f780f5
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. --> ### PR Summary Fix: [[MSRC 118865] FileSystemProvider - Path traversal via PSRP filenames in Copy-Item -FromSession](https://dev.azure.com/msazure/One/_workitems/edit/38762093/) `Copy-Item -FromSession` builds local destination paths from item, directory, and alternate-data-stream names returned by the remote PSRP endpoint without validating them. A malicious or compromised endpoint can return a name containing "".."", a path separator, a drive/root, or "":"" to write files outside the user-selected -Destination (for example the Startup folder or a PowerShell profile), yielding arbitrary file write and code execution in the client user's context This pull request prevents path traversal attacks for `Copy-Item -FromSession`. It introduces validation to ensure that remote-supplied file, directory, and alternate data stream names cannot be used to escape intended directories. **Security improvements for remote copy operations:** * Added a new method `CanRemoteNameCausePathTraversal` in `FileSystemProvider.cs` to detect potentially dangerous remote-supplied names that could enable path traversal. * Updated `CopyDirectoryFromRemoteSession` and `CopyFileFromRemoteSession` methods to validate remote directory, file, and alternate data stream names using the new method, and to throw descriptive errors if an unsafe name is detected. * Added new error messages to `FileSystemProviderStrings.resx` for directory, file, and alternate data stream path traversal attempts. **Testing enhancements:** * Introduced direct tests for `CanRemoteNameCausePathTraversal` with a variety of safe and unsafe names in `Copy-Item.Tests.ps1`. * Refactored remote session test setup. They haven't been running for PS7. This PR used a helper function and updated test tags to ensure tests run in the correct environments.