Prevent spec-derived values from escaping AutoRest output directories

[Copilot]

The AutoRest emitter interpolated raw service names and API versions into filesystem paths, allowing traversal-like spec values to escape configured directories.

• Path sanitization

  • Sanitize {service-name} and {version} in output paths.
  • Sanitize versions used to locate examples.
  • Preserve benign names and versions unchanged.

• Compiler integration

  • Update the TypeSpec core reference to consume sanitizePathSegment.

• Regression coverage

  • Cover path separators, traversal sequences, dot-only versions, and normal values.

@versioned(Versions)
@service namespace Service {
  enum Versions {
    v1: "../../../escaped"
  }
}

The version is emitted as .._.._.._escaped, keeping generated and example paths within their configured directories.

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@azure-tools/typespec-autorest@5340

commit: 2d5438b

[github-actions]

All changed packages have been documented.

• ✅ @azure-tools/typespec-autorest

Show changes

@azure-tools/typespec-autorest - fix ✏️

Sanitize spec-provided service names and versions used in output and example paths so they cannot escape their configured directories.

[github-actions]

📦 Package size report

✅ No notable package size changes compared to the base branch.

13 package(s) with no notable change

Package	Packed (base → head)	Δ Packed	Unpacked (base → head)	Δ Unpacked
@azure-tools/typespec-java	13.51 MB → 13.51 MB	+89 B (+0.0%)	15.03 MB → 15.03 MB	—
@azure-tools/typespec-autorest	80.93 KB → 81.01 KB	+85 B (+0.1%)	395.06 KB → 395.40 KB	+348 B (+0.1%)
@azure-tools/typespec-azure-portal-core	42.40 KB → 42.40 KB	+3 B (+0.0%)	192.91 KB → 192.91 KB	—
@azure-tools/azure-http-specs	146.71 KB → 146.71 KB	—	1.16 MB → 1.16 MB	—
@azure-tools/typespec-autorest-canonical	7.42 KB → 7.42 KB	—	26.00 KB → 26.00 KB	—
@azure-tools/typespec-azure-core	129.43 KB → 129.43 KB	—	702.77 KB → 702.77 KB	—
@azure-tools/typespec-azure-resource-manager	171.92 KB → 171.92 KB	—	1.04 MB → 1.04 MB	—
@azure-tools/typespec-azure-rulesets	5.16 KB → 5.16 KB	—	32.09 KB → 32.09 KB	—
@azure-tools/typespec-client-generator-core	229.48 KB → 229.48 KB	—	1.23 MB → 1.23 MB	—
@azure-tools/typespec-go	260.21 KB → 260.21 KB	—	1.33 MB → 1.33 MB	—
@azure-tools/typespec-metadata	15.91 KB → 15.91 KB	—	62.26 KB → 62.26 KB	—
@azure-tools/typespec-python	42.22 KB → 42.22 KB	—	164.91 KB → 164.91 KB	—
@azure-tools/typespec-ts	536.71 KB → 536.71 KB	—	2.58 MB → 2.58 MB	—

_{Packed = gzipped .tgz published to npm. Unpacked = total extracted size. 🆕 added, 🗑️ removed. Packages from the core/ submodule are not included.
🔴 grew · 🟢 shrank — only changes of at least 512 B and 0.5% are marked.}

[azure-sdk-automation]

You can try these changes here

🛝 Playground	🌐 Website

[Timothee Guerin (timotheeguerin)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts against the latest main in commit 2d5438b86 and verified the AutoRest build, formatting, lint, and focused tests.