GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Improve error handling for cab extraction and limit module name to 128 characters by adityapatwardhan · Pull Request #28212 · PowerShell/PowerShell

Conversation

@adityapatwardhan

@adityapatwardhan Aditya Patwardhan (adityapatwardhan) commented Oct 14, 2026

Copy link
Copy Markdown
Member

PR Summary

This pull request improves the robustness and security of the Cabinet extraction and Updatable Help code in PowerShell. The changes focus on better error handling for file operations, stricter validation of CAB entry paths, and defensive checks on module names to prevent issues with excessively long file paths.

Error handling and robustness improvements:

  • Added specific exception handling (e.g., UnauthorizedAccessException, ArgumentException, NotSupportedException, SecurityException) in FdiOpen to ensure that no exceptions escape into native code; instead, a failure is signaled with a return value, matching the existing IOException handling.
  • Improved FdiClose to handle invalid pointers and catch IOException, returning error codes instead of throwing exceptions.
  • In the FDI notification handler, now checks the result of FdiClose and aborts extraction if closing the file fails, preventing corrupt or truncated files from being reported as successfully extracted.
  • Corrected the check for valid file handles after CreateFile, ensuring that INVALID_HANDLE_VALUE is properly recognized as a failure.
  • Added explicit handling for the FdintNEXT_CABINET notification, returning an error code since only single-cabinet updates are supported.

Security and validation enhancements:

  • Strengthened path validation for CAB extraction: now rejects empty entry names and entries that resolve to the help directory root, preventing potential directory traversal or overwrite issues. [1] [2]

Defensive checks and user feedback:

  • Introduced a maximum module name length (MaxModuleNameLength = 128) to prevent excessively long module names from causing path or file name issues.
  • Added a user-facing error message and check in ProcessSingleModuleObject to reject modules with names exceeding the maximum length, with a localized error message in the resource file. [1] [2]

PR Context

PR Checklist

  • PR has a meaningful title
    • Use the present tense and imperative mood when describing your changes
  • Summarized changes
  • Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
  • This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
  • Breaking changes
    • None
    • OR
    • Experimental feature(s) needed
      • Experimental feature name(s):
  • User-facing changes
    • Not Applicable
    • OR
    • Documentation needed
      • Issue filed:
  • Testing - New and feature
    • N/A or can only be tested interactively
    • OR
    • Make sure you've added a new test if existing tests do not effectively test the code changed

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@adityapatwardhan
Improve error handling for cab extraction and limit module name to 12…
18f0257
…8 characters (#205)
@adityapatwardhan
Aditya Patwardhan (adityapatwardhan) requested review from a team and Dongbo Wang (daxian-dbw) as code owners October 14, 2026 22:55
Copilot AI balanced review requested due to automatic review settings October 14, 2026 22:55
@azure-pipelines

azure-pipelines Bot commented Oct 14, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot started reviewing on behalf of Aditya Patwardhan (adityapatwardhan) October 14, 2026 22:56
View session
@adityapatwardhan Aditya Patwardhan (adityapatwardhan) added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label Oct 14, 2026
Copilot AI reviewed Oct 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Regression coverage is needed for the module-name boundary and CAB extraction failure paths.

2 open findings
  • High severity Add regression coverage for cabinet extraction failure paths · New
  • Medium severity Add regression coverage for module-name length validation · New
What changed in this PR

This PR hardens PowerShell’s Updatable Help processing against CAB extraction failures and oversized module names.

Changes:

  • Improves native callback error handling and file-handle validation.
  • Rejects empty/root CAB entry paths and multi-cabinet continuation.
  • Enforces a 128-character module-name limit with a resource-backed error message.
File Description
src/​System.Management.Automation/​resources/​HelpDisplayStrings.resx Adds the oversized module-name error message.
src/​System.Management.Automation/​help/​UpdatableHelpModuleInfo.cs Defines the module-name length limit.
src/​System.Management.Automation/​help/​UpdatableHelpCommandBase.cs Rejects oversized module names during help discovery.
src/​System.Management.Automation/​help/​CabinetNativeApi.cs Strengthens extraction validation and failure handling.

🧠 Review effort: Balanced


💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread src/System.Management.Automation/help/CabinetNativeApi.cs
Comment on lines +486 to +488
if (closeResult != 0)
{
return IntPtr.Zero;
Comment thread src/System.Management.Automation/help/UpdatableHelpCommandBase.cs
return;
}

if (module.Name.Length > UpdatableHelpModuleInfo.MaxModuleNameLength)
@iSazonov

Ilya (iSazonov) commented Oct 15, 2026

Copy link
Copy Markdown
Collaborator

Dup #28203

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@jshigetomi Justin Chung (jshigetomi) closed this Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@daxian-dbw Dongbo Wang (daxian-dbw) Awaiting requested review from daxian-dbw daxian-dbw is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@adityapatwardhan @iSazonov @jshigetomi
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.