Repository navigation
.Net: Update file handling for FileIOPlugin - #14525
Conversation
Co-authored-by: Copilot App <[email protected]>
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
semantic-kernel-automation
Bot
added
the
.NET
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Non-empty allowlists can still expose disallowed-path details during canonicalization.
Review effort: Balanced
Findings: 1
What changed in this PR
Improves FileIOPlugin authorization ordering and error privacy.
Changes:
- Defers read-only checks until after authorization.
- Removes file paths from read-only errors.
- Adds regression tests for disallowed and read-only files.
| File | Description |
|---|---|
FileIOPlugin.cs |
Reorders validation and sanitizes errors. |
FileIOPluginTests.cs |
Adds privacy and authorization regression tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
GitHub Actions
Inactive
github-actions
Bot
changed the title
Co-authored-by: Copilot App <[email protected]>
GitHub Actions
Inactive
![semantic-kernel-automation[bot]](https://avatars.githubusercontent.com/u/189665073?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (2 commit(s)): 974f69900a4f, a2ad86c8b222
Model: gpt-5.6-sol
Overview
The change moves read-only probing behind allowlist authorization, short-circuits the default-deny configuration before filesystem access, and translates the main caller-path resolution failures into fixed denial responses. The added tests cover default and explicit configuration, inaccessible and cyclic paths, read-only files, and preservation of configuration errors. One target-specific exception remains outside the new translation boundary, so the documented denial behavior is incomplete for netstandard2.0 consumers on .NET Framework.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: dotnet/src/Plugins/Plugins.Core/FileIOPlugin.cs
Co-authored-by: Copilot App <[email protected]>
GitHub Actions
Inactive
GitHub Actions
Inactive
Co-authored-by: Copilot App <[email protected]>
GitHub Actions
Inactive
GitHub Actions
Inactive
Motivation and Context
Ensure
FileIOPluginapplies its configured access rules consistently and provides predictable error responses. This improves reliability for applications exposing file operations through kernel functions.Description
Refines
FileIOPluginpath validation and error handling while preserving its public API and configured folder restrictions. Adds regression coverage for both default and explicitly configured settings, including consistent error responses and continued enforcement of file-access rules.