Kiota Plugin Manifest Path Traversal Fix

Vulnerability Overview This vulnerability involves the potential resolution of the file reference to a location outside the plugin package when generating the plugin manifest, leading to potential security issues. Specifically, in the generated plugin manifest, the file reference must be a relative path and cannot point to an absolute path, URL, or (parent directory segment) outside the manifest package. Impact Scope Affected Files: - - Affected Versions: - From to Remediation 1. Code Modifications: - In , log messages were added to skip unsafe file references. - In , test cases were added to verify the effectiveness of the fix. 2. Specific Code Changes: - : - : ```csharp [Theory] [InlineData("././/.//.//.//etc/passwd")] [InlineData("../../../Windows\\System32\\config\\sam")] [InlineData("/etc/passwd")] [InlineData("\\\\server\\share\\oauthCard.json")] [InlineData("C:\\Windows\\System32\\drivers\\etc\\hosts")] [InlineData("http://attacker.example/vuln1")] [InlineData("file:///etc/passwd")] [InlineData("2b2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w2w

Goal Reached Thanks to every supporter — we hit 100%!

Kiota Plugin Manifest Path Traversal Fix

More from this source