Skip to content

.NET: Suppress false positive Zip Slip alert #7858

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SergeyMenshykh merged 5 commits into from
Aug 25, 2026
Merged

.NET: Suppress false positive Zip Slip alert #7858

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ebb0392
Suppress false positive Zip Slip alert
SergeyMenshykh Aug 25, 2026
f84445d
Fix FeatureDeclaration analyzer warning
SergeyMenshykh Aug 25, 2026
5603ab3
Remove unnecessary CodeAnalysis import
SergeyMenshykh Aug 25, 2026
a45de3f
Restore FeatureRegistry test imports
SergeyMenshykh Aug 25, 2026
d460522
Suppress platform-specific unused import warning
SergeyMenshykh Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dotnet/src/Microsoft.Agents.AI.Mcp/Skills/Loaders/AgentMcpSkillArchiveExtractor.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ private static void ExtractZip(Stream source, string fullTarget, int maxFileCoun
throw new InvalidDataException($"Skill archive exceeds the maximum allowed file count ({maxFileCount}).");
}

string? destination = ResolveDestination(fullTarget, entry.FullName);
string? destination = ResolveDestination(fullTarget, entry.FullName); // CodeQL [SM02729] ResolveDestination rejects paths outside fullTarget.
if (destination is null)
{
continue;
Expand Down
4 changes: 3 additions & 1 deletion dotnet/tests/Microsoft.Agents.AI.FeatureRegistry.UnitTests/FeatureRegistryTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,11 @@
using System.Globalization;
using System.IO;
using System.Linq;
#pragma warning disable IDE0005 // Required by Windows builds for Roslyn APIs.
using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.CSharp;
using Microsoft.CodeAnalysis.CSharp.Syntax;
#pragma warning restore IDE0005

namespace Microsoft.Agents.AI.FeatureRegistry.UnitTests;

Expand Down Expand Up @@ -431,5 +433,5 @@ private static void AssertNoErrors(IReadOnlyCollection<string> errors)

private sealed record RegistryEntry(int Index, string Id);

private sealed record FeatureDeclaration(string Owner, string MemberName, int Index, string FilePath);
private readonly record struct FeatureDeclaration(string Owner, string MemberName, int Index, string FilePath);
}
Loading