Copilot-assisted path validation still accepted encoded traversal in OpenAPI file references, allowing generated plugin manifests to read arbitrary files.

+    // Upper bound on percent-decode passes; enough to defeat multi-level (double) encoding without unbounded looping.+    private const int MaxPercentDecodePasses = 5;+     // Validates that a static_template file reference is a relative path that cannot point outside the manifest     // package: rejects absolute URIs, POSIX/UNC rooted paths, Windows drive paths, and '..' traversal (CWE-22/CWE-829).+    // The reference is percent-decoded first so encoded traversal sequences (e.g. %2e%2e for '..', %2f for '/',+    // %3a for ':') cannot bypass the checks below; decoding is repeated to defeat multi-level encoding.

+        // Percent-decode repeatedly until the value is stable so encoded (and double-encoded) traversal payloads+        // are normalized back to their literal form before validation.+        var decoded = file;+        for (var pass = 0; pass < MaxPercentDecodePasses; pass++)+        {+            var next = Uri.UnescapeDataString(decoded);+            if (string.Equals(next, decoded, StringComparison.Ordinal))+            {+                break;+            }+            decoded = next;+        }++        if (string.IsNullOrWhiteSpace(decoded))+        {+            return false;+        }+         // The manifest schema requires a relative file path; reject absolute URIs such as http(s):// or file://.-        if (Uri.TryCreate(file, UriKind.Absolute, out _))+        if (Uri.TryCreate(decoded, UriKind.Absolute, out _))         {             return false;         }          // Normalize separators so the checks below are OS-independent (the manifest is consumed on any platform).-        var normalized = file.Replace('\\', '/');+        var normalized = decoded.Replace('\\', '/');          // Reject POSIX-absolute and UNC-style rooted paths (e.g. /etc/passwd, //server/share).         if (normalized.StartsWith('/'))

     [InlineData("https://attacker.example/card.json", false)]     [InlineData("file:///etc/passwd", false)]+    // Percent-encoded traversal / URIs must be decoded before validation (CWE-22 / CWE-829).+    [InlineData("%2e%2e/card.json", false)]+    [InlineData("..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd", false)]+    [InlineData("file%3A%2F%2F%2Fetc%2Fpasswd", false)]+    [InlineData("%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd", false)]+    // Encoding hardening variants.+    [InlineData("%2E%2E/card.json", false)]+    [InlineData("..%5c..%5csecret.json", false)]+    [InlineData("https%3A%2F%2Fattacker.example%2Fcard.json", false)]

 using System.Collections.Generic;+using System.Linq;

-    // %3a for ':') cannot bypass the checks below; decoding is repeated to defeat multi-level encoding.+    // %3a for ':') cannot bypass the checks below; decoding is repeated to defeat multi-level encoding, residual+    // encoding beyond the decode budget fails closed, embedded control/NUL characters are rejected, and Unicode+    // compatibility forms are folded so full-width homoglyph traversal cannot slip through.

+        // Fail closed if percent-encoding remains after the decode budget is exhausted: undecoded residue+        // (e.g. more encoding levels than MaxPercentDecodePasses) could still be decoded by the downstream+        // consumer into a traversal sequence, so treat it as unsafe rather than accepting it verbatim.+        if (!string.Equals(Uri.UnescapeDataString(decoded), decoded, StringComparison.Ordinal))+        {+            return false;+        }++        // Fold Unicode compatibility forms (e.g. full-width '．'/'／') to their canonical ASCII equivalents so+        // homoglyph traversal payloads are normalized before the checks below. Validation only; the original+        // reference is still emitted verbatim.+        decoded = decoded.Normalize(System.Text.NormalizationForm.FormKC);++        // Reject control characters (e.g. an embedded NUL from %00) which can truncate the path in downstream+        // consumers and defeat the parent-directory segment check below.+        if (decoded.Any(char.IsControl))+        {+            return false;+        }+         // The manifest schema requires a relative file path; reject absolute URIs such as http(s):// or file://.         if (Uri.TryCreate(decoded, UriKind.Absolute, out _))         {

     // A benign filename containing an encoded space stays safe after decoding.     [InlineData("card%20name.json", true)]+    // Encoded NUL / control characters must be rejected (truncation + segment-check evasion).+    [InlineData("card%00.json", false)]+    [InlineData("safe.json%00%2e%2e%2fetc%2fpasswd", false)]+    // Encoding deeper than the decode budget must fail closed rather than pass residual %XX through.+    [InlineData("%25252525252e%25252525252e%25252525252fx", false)]+    [InlineData("%2525252525252e%2525252525252e%2525252525252fx", false)]