[AmirMS (AmelBawa-msft)]

📖 Description

FileCache::GetFile now validates the relative path from source data before using it, so cache reads, cleanup, and writes stay inside the cache directory. This covers the manifest, package version data, and icon caches.

It rejects paths that:

• have no file name, such as . or nested/
• are rooted, such as C:\file, C:file, or \file
• use .. to leave the cache directory
• have a segment that contains : or NUL, or ends in . or a space (Windows can resolve these to a different file)

Rejected paths fail with APPINSTALLER_CLI_ERROR_SOURCE_DATA_INTEGRITY_FAILURE. Valid paths are normalized for the cache; the upstream request still uses the original path.

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated Release Notes (if applicable)
• Updated documentation (if applicable)
• Added or updated tests (or noted why not applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

🤖 AI Assistance

• AI assistance was used and has been disclosed in this PR
• No AI assistance was used

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[Copilot]

🟡 Changes recommended

Unresolved validation gaps allow device aliases and normalized-away invalid components, while encoding conversion can reject valid Unicode paths.

3 open issues

• Reject Windows reserved device names in cache aliases · New
• Avoid UTF-8 path conversion in traversal checks · New
• Validate original path components before normalization · New

What changed in this PR

This PR adds path validation to WinGet’s shared file cache to keep source-provided paths within the cache directory.

Changes:

• Rejects escaping paths, missing filenames, and selected Windows path aliases before cache access.
• Normalizes cache paths while preserving the original path for upstream requests.
• Adds tests for invalid paths, external reads/deletes/writes, and valid nested paths.

File	Description
src/​AppInstallerCommonCore/​FileCache.cpp	Validates and normalizes paths before cache operations.
src/​AppInstallerCLITests/​FileCache.cpp	Adds path-validation and cache-containment regression tests.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unicode grapheme handling still allows colons to bypass validation and retain NTFS alternate data stream syntax.

2 open issues

• Reject colons hidden in Unicode grapheme clusters · New
• Avoid UTF-8 path conversion in traversal checks

2 resolved since last review

• Reject Windows reserved device names in cache aliases
• Validate original path components before normalization

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive Windows path handling needs native regression-test validation and final human review before approval.

No open issues 🎉

2 resolved since last review

• Reject colons hidden in Unicode grapheme clusters
• Avoid UTF-8 path conversion in traversal checks

_{Review effort: Balanced}