[unhield]

Pull Request

Thank you for contributing to Limoxel.

Summary

Harden marketplace storage against filesystem path-injection vulnerabilities and improve repository-wide CI test stability.

This change addresses the currently identified High-severity CodeQL path-injection findings across marketplace storage and strengthens the storage and locking boundaries against unsafe filesystem paths. It also stabilizes the repository-wide race-detector and coverage workload used by Continuous Integration.

Motivation

The marketplace storage layer constructed filesystem paths from identifiers that were not consistently validated at the storage boundary. This created multiple path-injection paths across metadata, artifacts, reviews, ratings, and process-file locking.

The repository-wide CI test workload also combined race detection, atomic coverage, verbose output, and unconstrained package-level concurrency. A previous hosted-runner execution lost communication after an extended race-test run.

This Pull Request addresses both issues as a focused security and stability correction while preserving existing marketplace behavior and validation coverage.

Type of Change

• Bug Fix
• Documentation Improvement
• Performance Improvement
• Platform Enhancement
• Refactoring
• Testing
• Build / CI
• Repository Maintenance
• Other

Description

The marketplace storage layer now enforces filesystem-safe identifier and digest validation before constructing storage paths.

The correction:

• validates storage identifiers before filesystem path construction
• rejects traversal, absolute, rooted, Windows volume, UNC, separator, control-character, and other unsafe path forms
• validates artifact digests according to their content-addressed storage requirements
• uses platform-aware path-locality and storage-root containment checks
• hardens atomic storage writes and rename operations
• applies the same storage boundary to process-file locking and stale-lock handling
• covers the corrected storage boundary with adversarial traversal and path-safety tests
• verifies that valid marketplace identifiers continue to function correctly
• validates that rejected inputs cannot create, modify, remove, or access files outside the intended storage tree

The Continuous Integration workflow was also updated to bound package-level test concurrency and provide a finite test timeout while retaining repository-wide testing, race detection, and atomic coverage.

The implementation remains within the existing marketplace storage and CI boundaries and does not introduce new product capabilities or alter the plugin ecosystem architecture.

Engineering Impact

• Architecture: Strengthens the existing marketplace storage security boundary without introducing a new storage architecture.
• Platform Components: Affects marketplace storage, artifact storage, metadata storage, reviews, ratings, process-file locking, and Continuous Integration.
• Repository Organization: Changes are limited to marketplace storage tests/implementation and the CI workflow.
• Engineering Contracts: Strengthens filesystem safety invariants while preserving valid marketplace identifier and artifact behavior.
• Public Interfaces: No public SDK or plugin interface changes.
• Performance: CI package concurrency is bounded to reduce resource pressure during repository-wide race and coverage validation. Runtime marketplace behavior is otherwise preserved.
• Backward Compatibility: Valid existing marketplace identifiers and storage operations remain supported. Unsafe filesystem-form inputs are rejected rather than interpreted as storage paths.

Documentation

• Yes
• No

No documentation update is required because the correction hardens existing security and validation behavior without introducing a new public-facing capability or interface.

Validation

The correction was validated through:

• Unit tests for marketplace storage path validation
• Adversarial traversal tests
• Unix and Windows-style path tests
• Absolute, rooted, UNC, and volume-path tests
• Invalid identifier and artifact digest tests
• Storage-root containment tests
• Process-file lock path-safety tests
• Positive tests for valid marketplace identifiers
• Marketplace package tests
• Repository-wide race-detector and coverage validation
• go vet ./...
• go build ./...
• gofmt validation
• git diff --check
• CodeQL path-injection validation

The repository-wide race/coverage workload was validated using bounded package concurrency and a finite test timeout while retaining race detection and atomic coverage.

Breaking Changes

• Yes
• No

No public API, SDK, plugin contract, or marketplace interface breaking changes are introduced.

Additional Notes

This Pull Request is a focused security and stability correction following the v1.5.0 Plugin Ecosystem release.

The correction addresses the identified marketplace filesystem path-injection findings and the previously observed Continuous Integration runner stability issue during repository-wide race and coverage validation.

No unrelated product features or subsequent platform-scale work are included.

The v1.5.0 release remains unchanged. Release metadata and tagging for v1.5.1 will be handled separately after the correction is merged and the final GitHub validation has completed successfully.

Contributor Checklist

• I have read the Contributing Guidelines.
• My changes follow the engineering standards of Limoxel.
• I have updated documentation where required.
• I have executed the appropriate validation.
• My contribution preserves repository organization.
• My contribution maintains architectural consistency.
• My contribution does not introduce unrelated changes.

Maintainer Review

Every Pull Request is reviewed according to the engineering standards of Limoxel.

Review considers:

• Engineering Quality
• Architectural Consistency
• Repository Organization
• Documentation Quality
• Validation Results
• Long-Term Maintainability
• Alignment with the Project Vision

Submission of a Pull Request does not guarantee acceptance.

A Pull Request may be:

• Merged
• Merged after requested revisions
• Deferred for a future milestone
• Closed if it does not align with the engineering direction of the project

Contributors are encouraged to discuss significant architectural or platform-wide changes before implementation.

If you are uncertain whether a proposed contribution aligns with the project's long-term direction, please contact:

hello.limoxel@gmail.com

Thank you for contributing to Limoxel.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.