Merge branch 'main' into apigurus

Author: gavinbarron

CHANGELOG.md

@@ -13,6 +13,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+## [1.34.0] - 2026-07-08
+
+### Added
+
+### Changed
+
+- Fixed a path traversal vulnerability where workspace consumer identifiers (`clientName`/`pluginName`) and workspace configuration keys were used as filesystem path components without containment validation, allowing a crafted name (e.g. `junk/../Victim`) to overwrite another consumer's cached OpenAPI description. [#7919](https://github.com/microsoft/kiota/issues/7919)
+
 ## [1.33.0] - 2026-07-06
 
 ### Added

it/python/requirements-dev.txt

@@ -4,7 +4,7 @@ astroid==4.0.4 ; python_full_version >= '3.7.2'
 
 certifi==2026.6.17 ; python_version >= '3.6'
 
-charset-normalizer==3.4.8 ; python_full_version >= '3.7.0'
+charset-normalizer==3.4.9 ; python_full_version >= '3.7.0'
 
 colorama==0.4.6 ; sys_platform == 'win32'
 
@@ -30,7 +30,7 @@ lazy-object-proxy==1.12.0 ; python_version >= '3.7'
 
 mccabe==0.7.0 ; python_version >= '3.6'
 
-mypy==2.1.0
+mypy==2.2.0
 
 mypy-extensions==1.1.0 ; python_version >= '3.5'
 

it/typescript/package-lock.json

@@ -20,7 +20,7 @@
   "devDependencies": {
     "@es-exec/esbuild-plugin-start": "^0.0.5",
     "@stylistic/eslint-plugin-ts": "^4.4.1",
-    "@types/node": "^26.1.0",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.63.0",
     "@typescript-eslint/parser": "^8.32.1",
     "esbuild": "^0.28.1",

it/typescript/package.json

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 using Kiota.Builder.Extensions;
@@ -386,23 +387,68 @@ fileNode is JsonValue fileValue &&
     // Inlined cards (no "file" property) are always considered safe.
     public bool HasUnsafeFileReference => File is not null && !IsSafeFileReference(File);
 
+    // Upper bound on percent-decode passes; enough to defeat multi-level (double) encoding without unbounded looping.
+    private const int MaxPercentDecodePasses = 5;
+
     // Validates that a static_template file reference is a relative path that cannot point outside the manifest
     // package: rejects absolute URIs, POSIX/UNC rooted paths, Windows drive paths, and '..' traversal (CWE-22/CWE-829).
+    // The reference is percent-decoded first so encoded traversal sequences (e.g. %2e%2e for '..', %2f for '/',
+    // %3a for ':') cannot bypass the checks below; decoding is repeated to defeat multi-level encoding, residual
+    // encoding beyond the decode budget fails closed, embedded control/NUL characters are rejected, and Unicode
+    // compatibility forms are folded so full-width homoglyph traversal cannot slip through.
     public static bool IsSafeFileReference(string? file)
     {
         if (string.IsNullOrWhiteSpace(file))
         {
             return false;
         }
 
+        // Percent-decode repeatedly until the value is stable so encoded (and double-encoded) traversal payloads
+        // are normalized back to their literal form before validation.
+        var decoded = file;
+        for (var pass = 0; pass < MaxPercentDecodePasses; pass++)
+        {
+            var next = Uri.UnescapeDataString(decoded);
+            if (string.Equals(next, decoded, StringComparison.Ordinal))
+            {
+                break;
+            }
+            decoded = next;
+        }
+
+        if (string.IsNullOrWhiteSpace(decoded))
+        {
+            return false;
+        }
+
+        // Fail closed if percent-encoding remains after the decode budget is exhausted: undecoded residue
+        // (e.g. more encoding levels than MaxPercentDecodePasses) could still be decoded by the downstream
+        // consumer into a traversal sequence, so treat it as unsafe rather than accepting it verbatim.
+        if (!string.Equals(Uri.UnescapeDataString(decoded), decoded, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        // Fold Unicode compatibility forms (e.g. full-width '．'/'／') to their canonical ASCII equivalents so
+        // homoglyph traversal payloads are normalized before the checks below. Validation only; the original
+        // reference is still emitted verbatim.
+        decoded = decoded.Normalize(System.Text.NormalizationForm.FormKC);
+
+        // Reject control characters (e.g. an embedded NUL from %00) which can truncate the path in downstream
+        // consumers and defeat the parent-directory segment check below.
+        if (decoded.Any(char.IsControl))
+        {
+            return false;
+        }
+
         // The manifest schema requires a relative file path; reject absolute URIs such as http(s):// or file://.
-        if (Uri.TryCreate(file, UriKind.Absolute, out _))
+        if (Uri.TryCreate(decoded, UriKind.Absolute, out _))
         {
             return false;
         }
 
         // Normalize separators so the checks below are OS-independent (the manifest is consumed on any platform).
-        var normalized = file.Replace('\\', '/');
+        var normalized = decoded.Replace('\\', '/');
 
         // Reject POSIX-absolute and UNC-style rooted paths (e.g. /etc/passwd, //server/share).
         if (normalized.StartsWith('/'))

src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs

@@ -1,5 +1,6 @@
 using System;
 using System.IO;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using AsyncKeyedLock;
@@ -21,7 +22,39 @@ public DescriptionStorageService(string targetDirectory)
         o.PoolSize = 20;
         o.PoolInitialFill = 1;
     });
-    private string GetDescriptionFilePath(string clientName, string extension) => Path.Combine(TargetDirectory, DescriptionsSubDirectoryRelativePath, clientName, $"openapi.{extension}");
+    private string GetDescriptionFilePath(string clientName, string extension)
+    {
+        ValidateConsumerName(clientName);
+        ValidateExtension(extension);
+        var documentsDirectory = Path.Join(TargetDirectory, DescriptionsSubDirectoryRelativePath);
+        var descriptionFilePath = Path.GetFullPath(Path.Combine(documentsDirectory, clientName, $"openapi.{extension}"));
+        var documentsFullPath = Path.GetFullPath(documentsDirectory);
+        var documentsFullPathWithSeparator = Path.EndsInDirectorySeparator(documentsFullPath) ? documentsFullPath : documentsFullPath + Path.DirectorySeparatorChar;
+        var comparison = OperatingSystem.IsWindows() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;
+        if (!descriptionFilePath.StartsWith(documentsFullPathWithSeparator, comparison))
+            throw new InvalidOperationException($"The consumer name '{clientName}' resolves to a path outside of the documents directory.");
+        return descriptionFilePath;
+    }
+    internal static void ValidateConsumerName(string clientName)
+    {
+        if (string.IsNullOrWhiteSpace(clientName))
+            throw new InvalidOperationException("The consumer name must not be empty or whitespace.");
+        if (Path.IsPathRooted(clientName) ||
+            clientName.Contains('/', StringComparison.Ordinal) ||
+            clientName.Contains('\\', StringComparison.Ordinal) ||
+            clientName.Split('/', '\\').Contains("..", StringComparer.Ordinal) ||
+            clientName is "." or "..")
+            throw new InvalidOperationException($"The consumer name '{clientName}' is not a valid single path segment and cannot navigate the file system.");
+    }
+    private static void ValidateExtension(string extension)
+    {
+        if (string.IsNullOrWhiteSpace(extension))
+            throw new InvalidOperationException("The description file extension must not be empty or whitespace.");
+        if (Path.IsPathRooted(extension) ||
+            extension.Contains('/', StringComparison.Ordinal) ||
+            extension.Contains('\\', StringComparison.Ordinal))
+            throw new InvalidOperationException($"The description file extension '{extension}' must not contain path separators or be rooted.");
+    }
     public async Task UpdateDescriptionAsync(string clientName, Stream description, string extension = "yml", CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(clientName);
@@ -62,7 +95,7 @@ public void RemoveDescription(string clientName, string extension = "yml")
     }
     public void Clean()
     {
-        var kiotaDirectoryPath = Path.Combine(TargetDirectory, DescriptionsSubDirectoryRelativePath);
+        var kiotaDirectoryPath = Path.Join(TargetDirectory, DescriptionsSubDirectoryRelativePath);
         if (Path.Exists(kiotaDirectoryPath))
             Directory.Delete(kiotaDirectoryPath, true);
     }

src/Kiota.Builder/WorkspaceManagement/DescriptionStorageService.cs

@@ -111,20 +111,22 @@ private void ValidateConsumerOutputPaths(WorkspaceConfiguration? configuration)
         foreach (var client in configuration.Clients)
             try
             {
+                DescriptionStorageService.ValidateConsumerName(client.Key);
                 BaseApiConsumerConfiguration.ValidateOutputPath(client.Value.OutputPath, workspaceDirectory);
             }
             catch (InvalidOperationException ex)
             {
-                throw new InvalidOperationException($"The client {client.Key} has an invalid output path: {ex.Message}", ex);
+                throw new InvalidOperationException($"The client {client.Key} has an invalid configuration: {ex.Message}", ex);
             }
         foreach (var plugin in configuration.Plugins)
             try
             {
+                DescriptionStorageService.ValidateConsumerName(plugin.Key);
                 BaseApiConsumerConfiguration.ValidateOutputPath(plugin.Value.OutputPath, workspaceDirectory);
             }
             catch (InvalidOperationException ex)
             {
-                throw new InvalidOperationException($"The plugin {plugin.Key} has an invalid output path: {ex.Message}", ex);
+                throw new InvalidOperationException($"The plugin {plugin.Key} has an invalid configuration: {ex.Message}", ex);
             }
     }
     public async Task BackupConfigAsync(CancellationToken cancellationToken = default)

src/Kiota.Builder/WorkspaceManagement/WorkspaceConfigurationStorageService.cs

@@ -42,6 +42,7 @@ public WorkspaceManagementService(ILogger logger, HttpClient httpClient, bool us
     private readonly DescriptionStorageService descriptionStorageService;
     public async Task<bool> IsConsumerPresentAsync(string clientName, CancellationToken cancellationToken = default)
     {
+        DescriptionStorageService.ValidateConsumerName(clientName);
         if (!UseKiotaConfig) return false;
         var (wsConfig, _) = await workspaceConfigurationStorageService.GetWorkspaceConfigurationAsync(cancellationToken).ConfigureAwait(false);
         return wsConfig is not null && (wsConfig.Clients.ContainsKey(clientName) || wsConfig.Plugins.ContainsKey(clientName));
@@ -68,6 +69,7 @@ private BaseApiConsumerConfiguration UpdateConsumerConfiguration(GenerationConfi
     public async Task UpdateStateFromConfigurationAsync(GenerationConfiguration generationConfiguration, string descriptionHash, Dictionary<string, HashSet<string>> templatesWithOperations, Stream descriptionStream, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(generationConfiguration);
+        DescriptionStorageService.ValidateConsumerName(generationConfiguration.ClientClassName);
         if (UseKiotaConfig)
         {
             var (wsConfig, manifest) = await LoadConfigurationAndManifestAsync(cancellationToken).ConfigureAwait(false);
@@ -154,6 +156,7 @@ public async Task<bool> ShouldGenerateAsync(GenerationConfiguration inputConfig,
     }
     public async Task<Stream?> GetDescriptionCopyAsync(string clientName, string inputPath, bool cleanOutput, CancellationToken cancellationToken = default)
     {
+        DescriptionStorageService.ValidateConsumerName(clientName);
         if (!UseKiotaConfig || cleanOutput)
             return null;
         return await descriptionStorageService.GetDescriptionAsync(clientName, new Uri(inputPath).GetFileExtension(), cancellationToken).ConfigureAwait(false);
@@ -178,6 +181,7 @@ public Task RemovePluginAsync(string clientName, bool cleanOutput = false, Cance
     }
     private async Task RemoveConsumerInternalAsync<T>(string consumerName, Func<WorkspaceConfiguration, Dictionary<string, T>> consumerRetrieval, bool cleanOutput, string consumerDisplayName, CancellationToken cancellationToken) where T : BaseApiConsumerConfiguration
     {
+        DescriptionStorageService.ValidateConsumerName(consumerName);
         if (!UseKiotaConfig)
             throw new InvalidOperationException($"Cannot remove a {consumerDisplayName} in lock mode");
         var (wsConfig, manifest) = await workspaceConfigurationStorageService.GetWorkspaceConfigurationAsync(cancellationToken).ConfigureAwait(false);

src/Kiota.Builder/WorkspaceManagement/WorkspaceManagementService.cs

@@ -269,6 +269,27 @@ public void Serializes()
     [InlineData("http://attacker.example/exfil", false)]
     [InlineData("https://attacker.example/card.json", false)]
     [InlineData("file:///etc/passwd", false)]
+    // Percent-encoded traversal / URIs must be decoded before validation (CWE-22 / CWE-829).
+    [InlineData("%2e%2e/card.json", false)]
+    [InlineData("..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd", false)]
+    [InlineData("file%3A%2F%2F%2Fetc%2Fpasswd", false)]
+    [InlineData("%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd", false)]
+    // Encoding hardening variants.
+    [InlineData("%2E%2E/card.json", false)]
+    [InlineData("..%5c..%5csecret.json", false)]
+    [InlineData("https%3A%2F%2Fattacker.example%2Fcard.json", false)]
+    [InlineData("%252e%252e%252fcard.json", false)]
+    // A benign filename containing an encoded space stays safe after decoding.
+    [InlineData("card%20name.json", true)]
+    // Encoded NUL / control characters must be rejected (truncation + segment-check evasion).
+    [InlineData("card%00.json", false)]
+    [InlineData("safe.json%00%2e%2e%2fetc%2fpasswd", false)]
+    // Encoding deeper than the decode budget must fail closed rather than pass residual %XX through.
+    [InlineData("%25252525252e%25252525252e%25252525252fx", false)]
+    [InlineData("%2525252525252e%2525252525252e%2525252525252fx", false)]
+    // Unicode full-width homoglyph traversal (literal and percent-encoded UTF-8) is folded and rejected.
+    [InlineData("\uFF0E\uFF0E/card.json", false)]
+    [InlineData("%EF%BC%8E%EF%BC%8E/card.json", false)]
     public void StaticTemplateIsSafeFileReferenceValidatesPaths(string file, bool expectedSafe)
     {
         Assert.Equal(expectedSafe, ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference(file));

tests/Kiota.Builder.Tests/OpenApiExtensions/OpenApiAiCapabilitiesExtensionTests.cs

@@ -46,4 +46,86 @@ public async Task DefensiveAsync()
         await Assert.ThrowsAsync<ArgumentNullException>(() => service.UpdateDescriptionAsync("foo", null, cancellationToken: TestContext.Current.CancellationToken));
         await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetDescriptionAsync(null, cancellationToken: TestContext.Current.CancellationToken));
     }
+
+    [Theory]
+    [InlineData("junk/../Victim")]
+    [InlineData("../Victim")]
+    [InlineData("..")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    [InlineData("./Victim")]
+    [InlineData(".")]
+    [InlineData(" ")]
+    public async Task UpdateDescriptionRejectsTraversalNamesAsync(string clientName)
+    {
+        var service = new DescriptionStorageService(tempPath);
+        using var stream = new MemoryStream();
+        stream.WriteByte(0x1);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.UpdateDescriptionAsync(clientName, stream, cancellationToken: TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task UpdateDescriptionTraversalDoesNotEscapeConsumerNamespaceAsync()
+    {
+        var service = new DescriptionStorageService(tempPath);
+        using var victimStream = new MemoryStream();
+        victimStream.WriteByte(0x2);
+        await service.UpdateDescriptionAsync("Victim", victimStream, cancellationToken: TestContext.Current.CancellationToken);
+
+        using var maliciousStream = new MemoryStream();
+        maliciousStream.WriteByte(0x9);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.UpdateDescriptionAsync("junk/../Victim", maliciousStream, cancellationToken: TestContext.Current.CancellationToken));
+
+        // The victim's cached description must remain untouched (single byte 0x2 written above).
+        var victimFilePath = Path.Combine(tempPath, DescriptionStorageService.DescriptionsSubDirectoryRelativePath, "Victim", "openapi.yml");
+        Assert.True(File.Exists(victimFilePath));
+        var contents = await File.ReadAllBytesAsync(victimFilePath, TestContext.Current.CancellationToken);
+        Assert.Equal([0x2], contents);
+    }
+
+    [Theory]
+    [InlineData("junk/../Victim")]
+    [InlineData("../Victim")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    public async Task GetDescriptionRejectsTraversalNamesAsync(string clientName)
+    {
+        var service = new DescriptionStorageService(tempPath);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.GetDescriptionAsync(clientName, cancellationToken: TestContext.Current.CancellationToken));
+    }
+
+    [Theory]
+    [InlineData("junk/../Victim")]
+    [InlineData("../Victim")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    public void RemoveDescriptionRejectsTraversalNames(string clientName)
+    {
+        var service = new DescriptionStorageService(tempPath);
+        Assert.Throws<InvalidOperationException>(() => service.RemoveDescription(clientName));
+    }
+
+    [Theory]
+    [InlineData("../evil")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    [InlineData("")]
+    [InlineData(" ")]
+    public async Task UpdateDescriptionRejectsInvalidExtensionsAsync(string extension)
+    {
+        var service = new DescriptionStorageService(tempPath);
+        using var stream = new MemoryStream();
+        stream.WriteByte(0x1);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.UpdateDescriptionAsync("clientName", stream, extension, cancellationToken: TestContext.Current.CancellationToken));
+    }
+
+    [Theory]
+    [InlineData("../evil")]
+    [InlineData("a/b")]
+    [InlineData("a\\b")]
+    public async Task GetDescriptionRejectsInvalidExtensionsAsync(string extension)
+    {
+        var service = new DescriptionStorageService(tempPath);
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.GetDescriptionAsync("clientName", extension, cancellationToken: TestContext.Current.CancellationToken));
+    }
 }