fix(core): prevent app package path traversal by Alive-Fish · Pull Request #16537 · OfficeDev/microsoft-365-agents-toolkit

Alive-Fish · 2026-08-06T08:45:02Z

Summary

constrain $[file()] and package sources to their manifest/app-package trust boundaries using lexical and canonical path checks
publish resolved manifests and ZIP output transactionally, restoring prior outputs on failure
show the failing reference, resolved target, manifest directory, and remediation in local VS Code and CLI diagnostics
keep telemetry-facing errors path-free while local lifecycle summaries use actionable display messages

Scenarios

Existing scenarios strengthened

valid in-directory file references and package assets continue to work
package assets, agent skills, symlinks/junctions, and package-size failures now have stronger containment and no-partial-artifact coverage

New scenarios

reject parent/sibling traversal, external absolute paths, Windows cross-drive/UNC paths, and canonical symlink escapes
apply the same containment policy to environment-variable and nested file() references
show the rejected reference, resolved target, manifest directory, and remediation in VS Code and CLI lifecycle summaries/local logs
keep telemetry-facing errors path-free and verify that local displayMessage content is not uploaded
stage all outputs, reject output collisions/aliases, and roll back JSON/ZIP publication failures
verify the complete atk package traversal failure workflow with a credential-free CLI E2E

Behavior is specified in resolve-manifest-file-reference.md.

Screenshot

Lifecycle Summary error message

Validation

affected fx-core suites: 178 tests passed
focused CLI E2E: 1 passed
fx-core build: passed
changed TypeScript files: ESLint 0 errors
Prettier and git diff --check: passed
local patch line coverage against the PR base: 92.2%

Restrict manifest file references and ZIP sources to trusted directories, publish package outputs transactionally, and add security regression coverage.

github-actions · 2026-08-06T08:46:04Z

❌ VscUse Test Plan — Tests failure

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Results: ✅ 3 passed · ❌ 2 failed (of 5 plans)

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure (3/5 passed)

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

github-actions · 2026-08-06T08:48:10Z

E2E Test Selection — AI Selected

Why these tests: AI selection failed — will fall back to all cases

Cases selected (1):

./vs/FoundryProxyAgent.dotnet.tests.ts

View pipeline run

Need to run more tests?

Comment on this PR:

/e2e-run ./path/to/test.tests.ts — add specific cases to AI selection
/e2e-run-all — run all e2e cases

Then re-run the workflow.

…ainment

github-actions · 2026-08-07T04:19:29Z

❌ VscUse Test Plan — Tests failure

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Results: ✅ 3 passed · ❌ 2 failed (of 5 plans)

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure (3/5 passed)

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Alive-Fish · 2026-08-07T05:53:25Z

/atk-vscuse-test Run exactly these plans:
da-no-action--da-no-action-remote-preview,
da-api-plugin-from-scratch--da-api-plugin-from-scratch-ts,
Feature_DA_Manifest_File_Function_Path_Support

github-actions · 2026-08-07T05:54:06Z

🎯 VscUse test plan hint from Alive-Fish:

Run exactly these plans:
da-no-action--da-no-action-remote-preview,
da-api-plugin-from-scratch--da-api-plugin-from-scratch-ts,
Feature_DA_Manifest_File_Function_Path_Support

The next atk-vscuse-test run will pass this hint to the AI plan selector.

github-actions · 2026-08-07T05:55:06Z

❌ VscUse Test Plan — Tests failure

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Results: ✅ 4 passed · ❌ 1 failed (of 5 plans)

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure (4/5 passed)

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

…ainment

github-actions · 2026-08-07T07:31:34Z

❌ VscUse Test Plan — Tests failure

Why these tests: Applied the authoritative user hint exactly; all three requested plans exist.

Branch diff: fix/manifest-file-containment → dev

Results: ✅ 2 passed · ❌ 1 failed (of 3 plans)

Plans run:

da-no-action--da-no-action-remote-preview
da-api-plugin-from-scratch--da-api-plugin-from-scratch-ts
Feature_DA_Manifest_File_Function_Path_Support

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure (2/3 passed)

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Separate local file paths from telemetry-safe app package errors, preserve publication errors during rollback cleanup, and strengthen containment and transactional output tests.

github-actions · 2026-08-10T03:21:51Z

❌ VscUse Test Plan — Tests failure

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Results: ✅ 3 passed · ❌ 2 failed (of 5 plans)

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure (3/5 passed)

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

codecov · 2026-08-10T03:34:27Z

Codecov Report

❌ Patch coverage is 89.54545% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.94%. Comparing base (7d8ba7a) to head (aa49c37).
⚠️ Report is 5 commits behind head on dev.

Files with missing lines	Patch %	Lines
.../src/component/driver/teamsApp/createAppPackage.ts	87.20%	11 Missing and 11 partials ⚠️
packages/fx-core/src/error/teamsApp.ts	80.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##              dev   #16537    +/-   ##
========================================
  Coverage   87.94%   87.94%            
========================================
  Files         650      651     +1     
  Lines       34379    34556   +177     
  Branches     8148     8184    +36     
========================================
+ Hits        30235    30392   +157     
- Misses       2314     2325    +11     
- Partials     1830     1839     +9

Files with missing lines	Coverage Δ
...s/fx-core/src/component/configManager/lifecycle.ts	`93.66% <100.00%> (+0.09%)`	⬆️
...es/fx-core/src/component/utils/envFunctionUtils.ts	`95.19% <100.00%> (+2.88%)`	⬆️
packages/fx-core/src/error/teamsApp.ts	`95.65% <80.00%> (-4.35%)`	⬇️
.../src/component/driver/teamsApp/createAppPackage.ts	`91.61% <87.20%> (-2.23%)`	⬇️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add app package tests for output inspection errors and rollback cleanup failures to raise patch coverage.

github-actions · 2026-08-10T04:23:45Z

❌ VscUse Test Plan — Tests unknown

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Show the failing reference, resolved path, manifest directory, and remediation in the VS Code output channel while keeping CLI and telemetry-facing errors path-free.

github-actions · 2026-08-10T05:01:54Z

❌ VscUse Test Plan — Tests unknown

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Use actionable display messages in VS Code lifecycle summaries, remove the redundant Output-panel prompt, and retain path-free messages for CLI and telemetry.

github-actions · 2026-08-10T05:33:03Z

❌ VscUse Test Plan — Tests unknown

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Use path-rich display messages for local lifecycle summaries and logs while retaining a generic telemetry message. Update security acceptance criteria and add unit and CLI E2E coverage.

github-actions · 2026-08-10T05:53:13Z

❌ VscUse Test Plan — Tests unknown

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Show original references, resolved targets, user-visible manifest directories, and owner-neutral remediation for package asset containment errors while keeping telemetry messages path-free. Add root, nested, and canonical diagnostics coverage.

github-actions · 2026-08-10T06:16:51Z

❌ VscUse Test Plan — Tests unknown

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

Pass the non-translatable $[file()] syntax as a localization formatting argument and verify it remains in rendered diagnostics.

github-actions · 2026-08-10T06:55:10Z

❌ VscUse Test Plan — Tests failure

Why these tests: AI selection unavailable (source=smoke-fallback); using smoke test cases as fallback.

Branch diff: fix/manifest-file-containment → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug
Message_extension_ts_remote_debug
DA_Oauth_js_Remote_Debug
Teams_Agent_With_Data_AI_Search_Azure_OpenAI_ts_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure

🔗 Full pipeline results

ℹ️ How were these tests selected?

GitHub Copilot (GPT-5.6-sol, high reasoning) analysed the PR title, description, and the diff between
fix/manifest-file-containment and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

fix(core): prevent app package path traversal

d1c6089

Restrict manifest file references and ZIP sources to trusted directories, publish package outputs transactionally, and add security regression coverage.

Alive-Fish requested review from HuihuiWu-Microsoft, Sherylueen (Sherylueen), qfai, qinqingxu, Qinzhou Xu (qinzhouxu), Yu Zhang (summzhan), Ning Tang (tecton), Alice Wang (wh-alice) and Yuqi Zhou (yuqizhou77) as code owners August 6, 2026 08:45

Alive-Fish temporarily deployed to engineering August 6, 2026 08:45 — with GitHub Actions Inactive

Alive-Fish temporarily deployed to engineering August 6, 2026 08:48 — with GitHub Actions Inactive

Alive-Fish had a problem deploying to engineering August 6, 2026 08:48 — with GitHub Actions Failure

Alive-Fish temporarily deployed to engineering August 6, 2026 08:48 — with GitHub Actions Inactive

Alive-Fish had a problem deploying to engineering August 6, 2026 08:48 — with GitHub Actions Failure

Alive-Fish temporarily deployed to engineering August 6, 2026 08:48 — with GitHub Actions Inactive

Alive-Fish had a problem deploying to engineering August 6, 2026 08:48 — with GitHub Actions Failure

Alive-Fish temporarily deployed to engineering August 6, 2026 08:48 — with GitHub Actions Inactive

Merge remote-tracking branch 'origin/dev' into fix/manifest-file-cont…

e5e9999

…ainment

Merge remote-tracking branch 'origin/dev' into fix/manifest-file-cont…

be99034

…ainment

fix(fx-core): harden app package file handling

023eaab

Separate local file paths from telemetry-safe app package errors, preserve publication errors during rollback cleanup, and strengthen containment and transactional output tests.

test(fx-core): cover app package failure paths

86921f4

Add app package tests for output inspection errors and rollback cleanup failures to raise patch coverage.

fix(fx-core): add actionable file reference diagnostics

ddc4dad

Show the failing reference, resolved path, manifest directory, and remediation in the VS Code output channel while keeping CLI and telemetry-facing errors path-free.

fix(fx-core): show actionable lifecycle errors

228d7f7

Use actionable display messages in VS Code lifecycle summaries, remove the redundant Output-panel prompt, and retain path-free messages for CLI and telemetry.

fix(fx-core): show file reference paths in CLI

ace5e28

Use path-rich display messages for local lifecycle summaries and logs while retaining a generic telemetry message. Update security acceptance criteria and add unit and CLI E2E coverage.

HuihuiWu-Microsoft reviewed Aug 10, 2026

View reviewed changes

Comment thread packages/fx-core/resource/package.nls.json Outdated

Comment thread packages/fx-core/resource/package.nls.json Outdated

HuihuiWu-Microsoft previously approved these changes Aug 10, 2026

View reviewed changes

fix(fx-core): extract file function token from localization

aa49c37

Pass the non-translatable $[file()] syntax as a localization formatting argument and verify it remains in rendered diagnostics.

HuihuiWu-Microsoft approved these changes Aug 10, 2026

View reviewed changes

Alive-Fish mentioned this pull request Aug 10, 2026

fix(core): backport app package path traversal prevention to 6.14 #16582

Merged

Uh oh!

Conversation

Alive-Fish commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scenarios

Screenshot

Validation

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Selection — AI Selected

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

Alive-Fish commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

codecov Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Alive-Fish commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

codecov Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading