restricting logs, output to appdata local directory for write operations

src/Microsoft.PowerApps.TestEngine.Tests/Reporting/TestLoggerTests.cs

@@ -63,6 +63,8 @@ public void WriteToLogsFileThrowsOnInvalidPathTest()
             MockFileSystem.Setup(x => x.Exists(It.IsAny<string>())).Returns(false);
             MockFileSystem.Setup(x => x.IsValidFilePath(It.IsAny<string>())).Returns(false);
             MockFileSystem.Setup(x => x.CreateDirectory(It.IsAny<string>()));
+            MockFileSystem.Setup(x => x.GetTempPath()).Returns("");
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns("");
             MockFileSystem.Setup(x => x.WriteTextToFile(It.IsAny<string>(), It.IsAny<string[]>())).Callback((string filePath, string[] logs) =>
             {
                 createdLogs.Add(filePath, logs);

src/Microsoft.PowerApps.TestEngine.Tests/System/FileSystemTests.cs

@@ -1,8 +1,12 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
+using System.IO;
+using System;
 using Microsoft.PowerApps.TestEngine.System;
 using Xunit;
+using System.Linq;
+using Moq;
 
 namespace Microsoft.PowerApps.TestEngine.Tests.System
 {
@@ -15,7 +19,12 @@ public class FileSystemTests
         [InlineData("C:\\folder", true)]
         [InlineData("", false)]
         [InlineData(null, false)]
-        [InlineData("C:/fold:er", false)]
+        [InlineData("C:/fold>er/fg", false)]
+        [InlineData("C:/folder/f>g", false)]
+        [InlineData("C:/folder/f:g", false)]
+        [InlineData("C:/folder/fg/", false)]
+        [InlineData("../folder/fg", true)]
+        [InlineData("../folder/f:g", false)]
         public void IsValidFilePathTest(string? filePath, bool expectedResult)
         {
             var fileSystem = new FileSystem();
@@ -37,5 +46,70 @@ public void RemoveInvalidFileNameCharsTest(string inputFileName, string expected
             var result = fileSystem.RemoveInvalidFileNameChars(inputFileName);
             Assert.Equal(expectedFileName, result);
         }
+
+        [Fact]
+        public void IsWritePermittedFilePath_ValidRootedPath_ReturnsTrue()
+        {
+            var _fileSystem = new FileSystem();
+            var validPath = Path.Combine(_fileSystem.GetDefaultRootTestEngine(), "testfile.txt");
+            Assert.True(_fileSystem.IsWritePermittedFilePath(validPath));
+        }
+        [Fact]
+        public void IsWritePermittedFilePath_SameAsRootedPath_ReturnsFalse()
+        {
+            var _fileSystem = new FileSystem();
+            var validPath = Path.Combine(_fileSystem.GetDefaultRootTestEngine(), "");
+            Assert.False(_fileSystem.IsWritePermittedFilePath(validPath));
+        }
+
+
+        [Fact]
+        public void IsWritePermittedFilePath_RelativePath_ReturnsFalse()
+        {
+            var _fileSystem = new FileSystem();
+            var relativePath = @"..\testfile.txt";
+            Assert.False(_fileSystem.IsWritePermittedFilePath(relativePath));
+        }
+
+        [Fact]
+        public void IsWritePermittedFilePath_InvalidRootedPath_ReturnsFalse()
+        {
+            var _fileSystem = new FileSystem();
+            var invalidPath = Path.Combine(_fileSystem.GetTempPath(), "invalidfolder", "testfile.txt");
+            Assert.False(_fileSystem.IsWritePermittedFilePath(invalidPath));
+        }
+
+        [Fact]
+        public void IsWritePermittedFilePath_NullPath_ReturnsFalse()
+        {
+            var _fileSystem = new FileSystem();
+            Assert.False(_fileSystem.IsWritePermittedFilePath(null));
+        }
+
+        [Fact]
+        public void IsWritePermittedFilePath_ValidPathWithParentDirectoryTraversal_ReturnsFalse()
+        {
+            var _fileSystem = new FileSystem();
+            var pathWithParentTraversal = _fileSystem.GetDefaultRootTestEngine() + Path.DirectorySeparatorChar + @"..\testfile.txt";
+            Assert.False(_fileSystem.IsWritePermittedFilePath(pathWithParentTraversal));
+        }
+
+        [Fact]
+        public void WriteTextToFile_UnpermittedFilePath_ThrowsInvalidOperationException()
+        {
+            var _fileSystem = new FileSystem();
+            var invalidFilePath = "C:\\InvalidFolder\\testfile.txt";
+            var exception = Assert.Throws<InvalidOperationException>(() => _fileSystem.WriteTextToFile(invalidFilePath, ""));
+            Assert.Contains(invalidFilePath, exception.Message);
+        }
+
+        [Fact]
+        public void WriteTextToFile_ArrayText_UnpermittedFilePath_ThrowsInvalidOperationException()
+        {
+            var _fileSystem = new FileSystem();
+            var invalidFilePath = "C:\\InvalidFolder\\testfile.txt";
+            var exception = Assert.Throws<InvalidOperationException>(() => _fileSystem.WriteTextToFile(invalidFilePath, new string[] { "This should fail." }));
+            Assert.Contains(invalidFilePath, exception.Message);
+        }
     }
 }

src/Microsoft.PowerApps.TestEngine.Tests/TestEngineTests.cs

@@ -80,6 +80,7 @@ public async Task TestEngineWithDefaultParamsTest()
             var environmentId = "defaultEnviroment";
             var tenantId = new Guid("a01af035-a529-4aaf-aded-011ad676f976");
             var outputDirectory = new DirectoryInfo("TestOutput");
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
             var testRunId = Guid.NewGuid().ToString();
             var expectedOutputDirectory = outputDirectory.FullName;
             var testRunDirectory = Path.Combine(expectedOutputDirectory, testRunId.Substring(0, 6));
@@ -116,6 +117,8 @@ public async Task TestEngineWithInvalidLocaleTest()
             var environmentId = "defaultEnviroment";
             var tenantId = new Guid("a01af035-a529-4aaf-aded-011ad676f976");
             var outputDirectory = new DirectoryInfo("TestOutput");
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
+
             var testRunId = Guid.NewGuid().ToString();
             var expectedOutputDirectory = outputDirectory.FullName;
             var testRunDirectory = Path.Combine(expectedOutputDirectory, testRunId.Substring(0, 6));
@@ -154,6 +157,7 @@ public async Task TestEngineWithUnspecifiedLocaleShowsWarning()
             var environmentId = "defaultEnviroment";
             var tenantId = new Guid("a01af035-a529-4aaf-aded-011ad676f976");
             var outputDirectory = new DirectoryInfo("TestOutput");
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
             var testRunId = Guid.NewGuid().ToString();
             var expectedOutputDirectory = outputDirectory.FullName;
             var testRunDirectory = Path.Combine(expectedOutputDirectory, testRunId.Substring(0, 6));
@@ -203,6 +207,7 @@ public async Task TestEngineWithMultipleBrowserConfigTest()
             var expectedTestReportPath = "C:\\test.trx";
 
             SetupMocks(expectedOutputDirectory, testSettings, testSuiteDefinition, testRunId, expectedTestReportPath);
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
 
             var testEngine = new TestEngine(MockState.Object, ServiceProvider, MockTestReporter.Object, MockFileSystem.Object, MockLoggerFactory.Object, MockTestEngineEventHandler.Object);
             var testReportPath = await testEngine.RunTestAsync(testConfigFile, environmentId, tenantId, outputDirectory, domain, "");
@@ -241,6 +246,7 @@ public async Task TestEngineTest(DirectoryInfo outputDirectory, string domain, T
             var tenantId = new Guid("a01af035-a529-4aaf-aded-011ad676f976");
             var testRunId = Guid.NewGuid().ToString();
 
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
             var expectedOutputDirectory = outputDirectory;
             if (expectedOutputDirectory == null)
             {
@@ -347,6 +353,32 @@ public async Task TestEngineThrowsOnNullArguments(string? testConfigFilePath, st
             await Assert.ThrowsAsync<ArgumentNullException>(async () => await testEngine.RunTestAsync(testConfigFile, environmentId, tenantId, outputDirectory, domain, ""));
         }
 
+        [Theory]
+        [InlineData("C:\\testPath")]
+        [InlineData("testPath")]
+        [InlineData("..\\testPath")]
+        public async Task TestEngineExceptionOnNotPermittedOutputPath(string outputDirLoc)
+        {
+            var testConfigFile = new FileInfo("C:\\testPlan.fx.yaml");
+            var environmentId = "defaultEnviroment";
+            var tenantId = new Guid("a01af035-a529-4aaf-aded-011ad676f976");
+            var domain = "apps.powerapps.com";
+
+            MockTestReporter.Setup(x => x.CreateTestRun(It.IsAny<string>(), It.IsAny<string>())).Returns("abcdef");
+            MockTestReporter.Setup(x => x.StartTestRun(It.IsAny<string>()));
+            MockLoggerFactory.Setup(x => x.CreateLogger(It.IsAny<string>())).Returns(MockLogger.Object);
+            LoggingTestHelper.SetupMock(MockLogger);
+            MockTestLoggerProvider.Setup(x => x.CreateLogger(It.IsAny<string>())).Returns(MockLogger.Object);
+            MockTestEngineEventHandler.Setup(x => x.EncounteredException(It.IsAny<Exception>()));
+
+            var testEngine = new TestEngine(MockState.Object, ServiceProvider, MockTestReporter.Object, MockFileSystem.Object, MockLoggerFactory.Object, MockTestEngineEventHandler.Object);
+            var outputDirectory = new DirectoryInfo(outputDirLoc);
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns("C:\\testPath" + Path.DirectorySeparatorChar);
+            var testResultsDirectory = await testEngine.RunTestAsync(testConfigFile, environmentId, tenantId, outputDirectory, domain, "");
+            // UserInput Exception is handled within TestEngineEventHandler, and then returns the test results directory path
+            MockTestEngineEventHandler.Verify(x => x.EncounteredException(It.IsAny<UserInputException>()), Times.Once());
+        }
+
         [Fact]
         public async Task TestEngineReturnsPathOnUserInputErrors()
         {
@@ -370,6 +402,7 @@ public async Task TestEngineReturnsPathOnUserInputErrors()
 
             var testEngine = new TestEngine(MockState.Object, ServiceProvider, MockTestReporter.Object, MockFileSystem.Object, MockLoggerFactory.Object, MockTestEngineEventHandler.Object);
             var outputDirectory = new DirectoryInfo("TestOutput");
+            MockFileSystem.Setup(x => x.GetDefaultRootTestEngine()).Returns(outputDirectory.FullName);
 
             var testResultsDirectory = await testEngine.RunTestAsync(testConfigFile, environmentId, tenantId, outputDirectory, domain, "");
             // UserInput Exception is handled within TestEngineEventHandler, and then returns the test results directory path

src/Microsoft.PowerApps.TestEngine/Microsoft.PowerApps.TestEngine.csproj

@@ -29,7 +29,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
-    <PackageReference Include="Microsoft.Playwright" Version="1.47.0" />
+    <PackageReference Include="Microsoft.Playwright" Version="1.48.0" />
     <PackageReference Include="Microsoft.PowerFx.Interpreter" Version="1.2.0" />
     <PackageReference Include="Mono.Cecil" Version="0.11.5" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />

src/Microsoft.PowerApps.TestEngine/Reporting/TestLogger.cs

@@ -55,9 +55,7 @@ public void WriteToLogsFile(string directoryPath, string filter)
         {
             if (!_fileSystem.Exists(directoryPath))
             {
-                var assemblyLocation = Assembly.GetExecutingAssembly().Location;
-                var assemblyDirectory = Path.GetDirectoryName(assemblyLocation);
-                directoryPath = Path.Combine(assemblyDirectory, "logs");
+                directoryPath = Path.Combine(_fileSystem.GetDefaultRootTestEngine(), "logs");
                 _fileSystem.CreateDirectory(directoryPath);
             }