Summary

This PR addresses a critical security vulnerability where malicious actors could use path traversal sequences (../ or ..\) to access or modify files outside the intended directory scope in file operation methods.

Vulnerability Details

The following files were vulnerable to path traversal attacks:

• FileDataProvider.cs - Constructor, FilePath property setter, and MoveTo() method
• FileBackupPruner.cs - PruneBackupFiles() method
• FileBackupCreator.cs - CreateBackupFile() method

An attacker could potentially exploit this by providing malicious file paths like:

../../Windows/System32/config.xml
../../../etc/passwd
%2e%2e/sensitive-data.xml

Solution

Implemented a centralized PathValidator utility class that validates file paths before any file operations. The validator detects and blocks:

• Direct ../ sequences
• Direct ..\ sequences (Windows-style)
• URL-encoded %2e%2e sequences (case-insensitive)
• Null/empty paths

Example Protection

// Before: No validation
public FileDataProvider(string filePath) 
{
    FilePath = filePath; // Vulnerable!
}

// After: Path validated
public FileDataProvider(string filePath)
{
    PathValidator.ValidatePathOrThrow(filePath, nameof(filePath)); // Secure ✓
    _filePath = filePath;
}

Changes Made

New Files

• mRemoteNG/Tools/PathValidator.cs - Centralized path validation utility with two methods:
  • IsValidPath(string path) - Returns validation result
  • ValidatePathOrThrow(string path, string parameterName) - Throws ArgumentException for invalid paths

Modified Files

• FileDataProvider.cs - Added validation to constructor, FilePath setter, and MoveTo() method
• FileBackupPruner.cs - Added validation to PruneBackupFiles() method
• FileBackupCreator.cs - Replaced inline validation checks with centralized PathValidator

Inherited Protection

• FileDataProviderWithRollingBackup.cs - Automatically protected through base class inheritance

Test Coverage

Added 21 comprehensive test cases across 4 test files:

• PathValidatorTests.cs (13 tests) - Validates all detection scenarios including forward/backslash traversal, URL-encoded sequences, null/empty paths, and exception handling
• FileDataProviderTests.cs (+3 tests) - Tests constructor, property setter, and MoveTo validation
• FileBackupCreatorTests.cs (+2 tests) - Tests path traversal rejection in backup creation
• FileBackupPrunerTests.cs (3 tests) - Tests path traversal rejection in backup pruning

Backward Compatibility

✅ All changes are backward compatible

• Legitimate file operations continue to work normally
• Only malicious path traversal attempts are blocked
• No breaking changes to existing API
• Clear error messages for debugging

Security Impact

Before: Potential unauthorized file access/modification anywhere on the filesystem
After: All file paths validated, path traversal attacks blocked with ArgumentException

Code Metrics

• 8 files changed
• 261 lines added, 6 lines removed
• Net change: +255 lines
• Minimal, surgical changes focused only on security fixes

Fixes vulnerability reported in issue regarding path traversal attacks in file operations.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.