Files
UA-.NETStandard/fuzzing
Klaus Landsdorf f9a5e96600 OneFuzz validator: accept drop files reported through resolved links (#4640)
# Description

`ContractPaths.Relative` now also compares a path that seems to escape
against the root's real location, with every link along it resolved.
Links inside the drop are still rejected, because every caller resolves
the returned relative path segment by segment.

The new contract test
`DropReachedThroughALinkedDirectoryIsValidatedAsync` validates a drop
through a directory link and fails on every platform without the fix.
Its link is created like the one in the existing link test (a junction
on Windows, a symlink elsewhere), now through one shared helper, so it
needs no privileges and is never skipped.

Tests:

- On macOS, master passes 53 of 209 contract tests; with the fix 210/210
on net10.0 (Release, 0 skipped).
- Fork CI (full matrix incl. macOS) and CodeQL: green on `358eb33d5`
(the same change on master `029ac0f33`) — [CI run
36892610480](https://github.com/biancode/UA-.NETStandard/actions/runs/36892610480)
(189 jobs), [CodeQL run
36892614293](https://github.com/biancode/UA-.NETStandard/actions/runs/36892614293).
The branch is now on a newer master with no overlapping files; the run
on the current head is in progress: [CI run
37016188861](https://github.com/biancode/UA-.NETStandard/actions/runs/37016188861).

## Related Issues

- Fixes #4639

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (Affected
suites on net10.0 and net8.0 locally on macOS; .NET Framework is covered
by the fork CI's Windows net48 legs.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
2026-10-03 05:42:35 +02:00
..