ResolvePackageFileConflicts crashes when any items have { in the path

[zivkan]

Describe the bug

From this SO question: https://stackoverflow.com/questions/79827986/conflict-between-microsoft-aspnetcore-and-system-security-cryptography-pkcs?noredirect=1

The customer's username (previously) was {Username}, and so their NuGet packages are coming from C:\Users\{Username}\.nuget\packages.

The task is using string.Format correctly to crate a conflictMessage:

sdk/src/Tasks/Common/ConflictResolution/ConflictResolver.cs

Lines 173 to 175 in 6756697

	string conflictMessage = string.Format(CultureInfo.CurrentCulture, Strings.EncounteredConflict_Info,
	item1.DisplayName,
	item2.DisplayName);

However, it then passes this as a format string to Logger.LogMessage:

sdk/src/Tasks/Common/ConflictResolution/ConflictResolver.cs

Lines 190 to 191 in 6756697

	LogMessage(conflictMessage, Strings.CouldNotDetermineWinner_DoesNotExist_Info,
	!exists1 ? item1.DisplayName : item2.DisplayName);

sdk/src/Tasks/Common/ConflictResolution/ConflictResolver.cs

Lines 354 to 358 in 6756697

	private void LogMessage(string conflictMessage, string format, params object?[] args)
	{
	_log.LogMessage(
	MessageImportance.Low,
	conflictMessage + " " + string.Format(format, args));

sdk/src/Tasks/Common/Logger.cs

Lines 103 to 106 in 6756697

	return new Message(
	level,
	text: string.Format(format, args),
	code: code);

So, string.Format is eventually called with {Username} as part of the format string and throws an exception.

To Reproduce

Create a project that has at least one PackageReference, set the environment variable NUGET_PACKAGES to something like C:\{packages, then try to build the project.

Note that Windows allows { in file and directory names.

Exceptions (if any)

// Source - https://stackoverflow.com/q/79827986
// Posted by RandomSkinCreator, modified by community. See post 'Timeline' for change history
// Retrieved 2025-11-25, License - CC BY-SA 4.0

dotnet build
Restore complete (0.2s)
  MyApi net10.0 failed with 1 error(s) (0.0s)
    C:\Program Files\dotnet\sdk\10.0.100\Sdks\Microsoft.NET.Sdk\targets\Microsoft.NET.ConflictResolution.targets(40,5): error MSB4018:
      The "ResolvePackageFileConflicts" task failed unexpectedly.
      System.FormatException: Input string was not in a correct format. Failure to
      parse near offset 103. Expected an ASCII digit.
         at System.Text.ValueStringBuilder.AppendFormatHelper(IFormatProvider provi
      der, String format, ReadOnlySpan`1 args)
         at System.String.FormatHelper(IFormatProvider provider, String format, Rea
      dOnlySpan`1 args)
         at Microsoft.NET.Build.Tasks.Logger.CreateMessage(MessageLevel level, Stri
      ng format, String[] args)
         at Microsoft.NET.Build.Tasks.Logger.LogMessage(MessageImportance importanc
      e, String format, String[] args)
         at Microsoft.NET.Build.Tasks.ConflictResolution.ConflictResolver`1.Resolve
      Conflict(TConflictItem item1, TConflictItem item2, Boolean logUnresolvedConfl
      icts)
         at Microsoft.NET.Build.Tasks.ConflictResolution.ConflictResolver`1.Resolve
      Conflicts(IEnumerable`1 conflictItems, Func`2 getItemKey, ConflictCallback`1
      foundConflict, Boolean commitWinner)
         at Microsoft.NET.Build.Tasks.ConflictResolution.ResolvePackageFileConflict
      s.ExecuteCore()
         at Microsoft.NET.Build.Tasks.TaskBase.Execute()
         at Microsoft.Build.BackEnd.TaskExecutionHost.Execute()
         at Microsoft.Build.BackEnd.TaskBuilder.ExecuteInstantiatedTask(TaskExecuti
      onHost taskExecutionHost, TaskLoggingContext taskLoggingContext, TaskHost tas
      kHost, ItemBucket bucket, TaskExecutionMode howToExecuteTask)

Build failed with 1 error(s) in 0.5s

Further technical details

details of dotnet --info

- The IDE (VS / VS Code/ VS4Mac) you're running on, and its version