Preserve malformed JSON array shape and literal artifact filenames

Author: MariusStorhaug

.github/actions/Publish-PSModule/src/publish.ps1

@@ -65,13 +65,14 @@ LogGroup 'Load inputs' {
 #region Load release context
 LogGroup 'Load release context' {
     $pullRequestJson = $env:PSMODULE_PUBLISH_PSMODULE_INPUT_PullRequest
-    $pullRequest = if (-not [string]::IsNullOrWhiteSpace($pullRequestJson) -and $pullRequestJson -ne 'null') {
-        $pullRequestJson | ConvertFrom-Json
+    $pullRequest = $null
+    if (-not [string]::IsNullOrWhiteSpace($pullRequestJson) -and $pullRequestJson -ne 'null') {
+        $pullRequest = ConvertFrom-Json -InputObject $pullRequestJson -NoEnumerate -ErrorAction Stop
     } else {
         $githubEventJson = Get-Content -Raw $env:GITHUB_EVENT_PATH
         $githubEvent = $githubEventJson | ConvertFrom-Json
         if ($githubEvent.pull_request) {
-            [pscustomobject]@{
+            $pullRequest = [pscustomobject]@{
                 Number = $githubEvent.pull_request.number
             }
         }

.github/actions/Publish-PSModule/tests/Publish-PSModule.Preflight.Tests.ps1

@@ -365,6 +365,10 @@ Describe 'Publish-PSModule source-bound preflight' {
         @{ Json = '{"Number":0}' }
         @{ Json = '{"Number":"unknown"}' }
         @{ Json = '42' }
+        @{ Json = '[]' }
+        @{ Json = '[null]' }
+        @{ Json = '[{"Number":42}]' }
+        @{ Json = '[{"Number":0}]' }
     ) {
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_PullRequest = $Json
 

.github/actions/Release-PSModule/src/Release-PSModule.Helpers.psm1

@@ -153,7 +153,8 @@ function Get-PSModuleProducingPullRequestNumber {
         return 0L
     }
     $number = 0L
-    if (($PullRequest -isnot [PSCustomObject] -and $PullRequest -isnot [Collections.IDictionary]) -or
+    if ($PullRequest -is [array] -or
+        ($PullRequest -isnot [PSCustomObject] -and $PullRequest -isnot [Collections.IDictionary]) -or
         -not [long]::TryParse([string]$PullRequest.Number, [ref]$number) -or $number -lt 1) {
         throw 'Supplied pull request context requires a positive producing pull request number.'
     }
@@ -341,8 +342,13 @@ function Get-PSModuleArtifactFile {
         throw 'The tested module artifact contains no files.'
     }
     foreach ($file in $files) {
+        $relativePath = [IO.Path]::GetRelativePath($root, $file.FullName)
+        $relativePath = $relativePath.Replace([IO.Path]::DirectorySeparatorChar, [char]'/')
+        if ($relativePath.Contains('\')) {
+            throw 'The tested artifact contains a literal filename backslash. Refusing to rename its published file tree.'
+        }
         [pscustomobject]@{
-            RelativePath = [IO.Path]::GetRelativePath($root, $file.FullName).Replace('\', '/')
+            RelativePath = $relativePath
             FullName     = $file.FullName
         }
     }

.github/actions/Release-PSModule/src/release.ps1

@@ -99,10 +99,11 @@ LogGroup 'Load release context' {
     $githubEventJson = Get-Content -Raw $env:GITHUB_EVENT_PATH
     $githubEvent = $githubEventJson | ConvertFrom-Json
     $pullRequestJson = $env:PSMODULE_RELEASE_PSMODULE_INPUT_PullRequest
-    $pullRequest = if (-not [string]::IsNullOrWhiteSpace($pullRequestJson) -and $pullRequestJson -ne 'null') {
-        $pullRequestJson | ConvertFrom-Json
+    $pullRequest = $null
+    if (-not [string]::IsNullOrWhiteSpace($pullRequestJson) -and $pullRequestJson -ne 'null') {
+        $pullRequest = ConvertFrom-Json -InputObject $pullRequestJson -NoEnumerate -ErrorAction Stop
     } elseif ($githubEvent.pull_request) {
-        [pscustomobject]@{
+        $pullRequest = [pscustomobject]@{
             Number  = $githubEvent.pull_request.number
             Title   = $githubEvent.pull_request.title
             Body    = $githubEvent.pull_request.body

.github/actions/Release-PSModule/tests/Release-PSModule.Ownership.Tests.ps1

@@ -137,6 +137,25 @@ Describe 'Tested artifact identity' {
         Get-PSModuleArtifactDigest -Path $script:modulePath | Should -Not -BeExactly $original
     }
 
+    It 'rejects a literal Unix filename backslash before hashing or creating an archive' -Skip:$IsWindows {
+        [IO.File]::WriteAllText([IO.Path]::Combine($script:modulePath, 'data\value.txt'), 'Literal filename bytes.')
+        $archivePath = Join-Path -Path $TestDrive -ChildPath 'rejected-backslash.zip'
+
+        { Get-PSModuleArtifactDigest -Path $script:modulePath } | Should -Throw '*backslash*'
+        { New-PSModuleReleaseArchive -Path $script:modulePath -DestinationPath $archivePath } | Should -Throw '*backslash*'
+        Test-Path -LiteralPath $archivePath | Should -BeFalse
+    }
+
+    It 'does not treat a raw backslash file record as a directory path' {
+        $record = [pscustomobject]@{
+            RelativePath = 'data\value.txt'
+            Length       = 1L
+            Hash         = [byte[]](0..31)
+        }
+
+        { Get-PSModuleContentDigest -File @($record) } | Should -Throw '*path*'
+    }
+
     It 'compares raw nupkg payload files without importing or changing consumer metadata' {
         $packagePath = Join-Path -Path $TestDrive -ChildPath 'TestModule.1.2.4.nupkg'
         $stream = [IO.File]::Create($packagePath)

.github/actions/Release-PSModule/tests/Release-PSModule.WhatIf.Tests.ps1

@@ -256,9 +256,14 @@ Describe 'Release-PSModule WhatIf' {
         @($script:state.Release.assets).Count | Should -Be 0
     }
 
-    It 'rejects supplied PR context without a positive identity before release writes' {
+    It 'rejects supplied PR context without a positive identity before release writes' -ForEach @(
+        @{ Json = '{}' }
+        @{ Json = '[]' }
+        @{ Json = '[null]' }
+        @{ Json = '[{"Number":42}]' }
+    ) {
         $env:PSMODULE_RELEASE_PSMODULE_INPUT_WhatIf = 'false'
-        $env:PSMODULE_RELEASE_PSMODULE_INPUT_PullRequest = '{}'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_PullRequest = $Json
 
         { & $script:releaseScriptPath 1>$null 6>$null } | Should -Throw '*pull request*'