Updated extensions manager to handle CWE-22 & CWE-23 (#1643)

* Updated extensions manager to handle CWE-22 & CWE-23

* Fixed path on Linux and Mac

* Updated CI

* Update Xcode version to 26.1.1 in CI workflow

---------

Co-authored-by: Etienne Baudoux <[email protected]>

Author: btiteux

.github/workflows/ci.yml

@@ -38,13 +38,13 @@ jobs:
         run: ./build.cmd RunTests
   macos-latest:
     name: macOS
-    runs-on: macos-14
+    runs-on: macos-15
     timeout-minutes: 30
     steps:
-      - name: Set to use Xcode 15.1
+      - name: Set to use Xcode 26.1.1
         uses: maxim-lobanov/setup-xcode@v1
         with:
-          xcode-version: '15.1'
+          xcode-version: '26.1.1'
       - uses: actions/checkout@v3
       - name: 'Cache: .nuke/temp, ~/.nuget/packages'
         uses: actions/cache@v3

.gitignore

@@ -441,4 +441,7 @@ bld/
 [Oo]bj/
 # [Oo]ut/
 [Ll]og/
-[Ll]ogs/
+[Ll]ogs/
+
+# TestData
+!**/**/TestData/**

src/Directory.Packages.props

@@ -34,7 +34,7 @@
     <PackageVersion Include="NuGet.Packaging" Version="6.9.1" />
     <PackageVersion Include="Nuke.Common" Version="8.0.0" />
     <PackageVersion Include="OneOf" Version="3.0.271" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.5" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
     <PackageVersion Include="System.ComponentModel.Composition" Version="$(DotNetVersion)" />

src/app/dev/DevToys.Blazor/BuiltInTools/ExtensionsManager/ExtensionInstallationManager.cs

@@ -98,7 +98,7 @@ internal static async Task<ExtensionInstallationResult> InstallExtensionAsync(Sa
             if (Directory.Exists(potentialExtensionInstallationPath))
             {
                 // Extension is already installed.
-                return new(AlreadyInstalled: true, nuspecReader, ExtensionInstallationPath: string.Empty);
+                return new(true, nuspecReader, string.Empty);
             }
         }
 
@@ -112,11 +112,22 @@ string extensionInstallationPath
         {
             if (!pathToExclude.Any(path => packagedFile.Contains(path, StringComparison.CurrentCultureIgnoreCase)))
             {
-                reader.ExtractFile(packagedFile, Path.Combine(extensionInstallationPath, packagedFile), null);
+                // Security: Prevent path traversal vulnerability (CWE-22 & CWE-23).
+                string fullTargetPath = Path.GetFullPath(Path.Combine(extensionInstallationPath, packagedFile));
+                string fullPluginPath = Path.GetFullPath(extensionInstallationPath);
+
+                if (!fullTargetPath.StartsWith(fullPluginPath + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
+                {
+                    Directory.Delete(extensionInstallationPath, true);
+                    logger.LogCritical("Security violation: Extension '{packagedFile}' contains path traversal sequence", nuspecReader.GetId());
+                    return new(nuspecReader, $"Security violation: Extension '{nuspecReader.GetId()}' contains path traversal sequence");
+                }
+
+                reader.ExtractFile(packagedFile, fullTargetPath, null);
             }
         }
 
-        return new(AlreadyInstalled: false, nuspecReader, extensionInstallationPath);
+        return new(false, nuspecReader, extensionInstallationPath);
     }
 
     internal static async Task<bool> CheckForAnyUpdateAsync(IWebClientService webClientService)

src/app/dev/DevToys.Blazor/BuiltInTools/ExtensionsManager/ExtensionInstallationResult.cs

@@ -2,6 +2,25 @@
 
 namespace DevToys.Blazor.BuiltInTools.ExtensionsManager;
 
-internal record ExtensionInstallationResult(bool AlreadyInstalled, NuspecReader NuspecReader, string ExtensionInstallationPath)
+internal class ExtensionInstallationResult
 {
+    internal bool HasSucceeded => string.IsNullOrWhiteSpace(ErrorMessage);
+    internal bool AlreadyInstalled { get; }
+    internal NuspecReader NuspecReader { get; }
+    internal string ExtensionInstallationPath { get; } = string.Empty;
+    internal string ErrorMessage { get; } = string.Empty;
+
+    internal ExtensionInstallationResult(NuspecReader nuspecReader, string errorMessage)
+    {
+        ErrorMessage = errorMessage;
+        NuspecReader = nuspecReader;
+    }
+
+    internal ExtensionInstallationResult(bool alreadyInstalled, NuspecReader nuspecReader, string extensionInstallationPath)
+    {
+        AlreadyInstalled = alreadyInstalled;
+        NuspecReader = nuspecReader;
+        ExtensionInstallationPath = extensionInstallationPath;
+    }
 }
+