Harden Copy-Item -FromSession (#171) ---- #### AI description (iteration 1) #### PR Classification Security hardening to prevent path traversal vulnerabilities in the `Copy-Item -FromSession` cmdlet. #### PR Summary This PR adds validation to prevent path traversal attacks when copying files from remote sessions by checking for malicious characters and patterns in remote file/directory names and alternate data stream names. - `FileSystemProvider.cs`: Added `CanRemoteNameCausePathTraversal()` method to detect path traversal characters (`\`, `/`, `:` on Windows) and special names (`.`, `..`) in remote-supplied names - `FileSystemProvider.cs`: Integrated path traversal validation checks before processing remote directory names, file names, and alternate data stream names in copy operations - `Copy-Item.Tests.ps1`: Added comprehensive test cases validating the path traversal detection logic with benign and malicious filename patterns - `FileSystemProviderStrings.resx`: Added error messages for directory name, file name, and alternate data stream path traversal violations <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Pester Testing Test Guide
Also see the Writing Pester Tests document.
Running Pester Tests
Go to the top level of the PowerShell repository and run: Start-PSPester
inside a self-hosted copy of PowerShell.
You can use Start-PSPester -Tests SomeTestSuite* to limit the tests run.
Testing new powershell processes
Any launch of a new powershell process must include -noprofile so that
modified user and system profiles do not causes tests to fail. You also must
take care to call the development copy of PowerShell, which is not the first
one on the path.
Example:
$powershell = Join-Path -Path $PsHome -ChildPath "pwsh"
& $powershell -noprofile -command "ExampleCommand" | Should Be "ExampleOutput"
Portability
Some tests simply must be tied to certain platforms. Use Pester's
-Skip directive on an It statement to do this. For instance to run
the test only on Windows:
It "Should do something on Windows" -Skip:($IsLinux -Or $IsMacOS) { ... }
Or only on Linux and OS X:
It "Should do something on Linux" -Skip:$IsWindows { ... }
Pending
When writing a test that should pass, but does not, please do not skip or delete
the test, but use It "Should Pass" -Pending to mark the test as pending, and
file an issue on GitHub.