.Net: Reject mixed-separator UNC paths in file plugins

dotnet/src/Plugins/Plugins.Core/FileIOPlugin.cs

@@ -113,7 +113,7 @@ private bool TryGetAllowedFilePath(string path, out string canonicalPath)
         Verify.NotNullOrWhiteSpace(path);
         canonicalPath = string.Empty;
 
-        if (path.StartsWith("\\\\", StringComparison.OrdinalIgnoreCase))
+        if (IsUncOrExtendedPath(path))
         {
             throw new ArgumentException("Invalid file path, UNC paths are not supported.", nameof(path));
         }
@@ -162,5 +162,10 @@ private bool TryGetAllowedFilePath(string path, out string canonicalPath)
 
         return false;
     }
+
+    private static bool IsUncOrExtendedPath(string path) =>
+        path.Length >= 2 &&
+        (path[0] is '/' or '\\') &&
+        (path[1] is '/' or '\\');
     #endregion
 }

dotnet/src/Plugins/Plugins.UnitTests/Core/FileIOPluginTests.cs

@@ -144,6 +144,41 @@ public async Task ItCannotReadFromDisallowedFoldersAsync()
         await Assert.ThrowsAsync<ArgumentException>(async () => await plugin.ReadAsync(Path.Combine("", Path.GetRandomFileName())));
     }
 
+    [Theory]
+    [InlineData("\\\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("//UNC/server/folder/myfile.txt")]
+    [InlineData("/\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("\\/UNC/server/folder/myfile.txt")]
+    public async Task ItRejectsUncOrExtendedPathsOnReadAsync(string path)
+    {
+        // Arrange
+        var plugin = new FileIOPlugin()
+        {
+            AllowedFolders = [Path.GetTempPath()]
+        };
+
+        // Act & Assert
+        await Assert.ThrowsAsync<ArgumentException>(() => plugin.ReadAsync(path));
+    }
+
+    [Theory]
+    [InlineData("\\\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("//UNC/server/folder/myfile.txt")]
+    [InlineData("/\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("\\/UNC/server/folder/myfile.txt")]
+    public async Task ItRejectsUncOrExtendedPathsOnWriteAsync(string path)
+    {
+        // Arrange
+        var plugin = new FileIOPlugin()
+        {
+            AllowedFolders = [Path.GetTempPath()],
+            DisableFileOverwrite = false
+        };
+
+        // Act & Assert
+        await Assert.ThrowsAsync<ArgumentException>(() => plugin.WriteAsync(path, "hello world"));
+    }
+
     [Fact]
     public async Task ItCannotReadThroughSymlinkOutsideAllowedFoldersAsync()
     {

dotnet/src/Plugins/Plugins.UnitTests/Web/WebFileDownloadPluginTests.cs

@@ -230,6 +230,26 @@ public async Task DownloadToFileFailsForInvalidParametersAsync()
         await Assert.ThrowsAsync<InvalidOperationException>(async () => await webFileDownload.DownloadToFileAsync(validUri, "myfile.txt"));
     }
 
+    [Theory]
+    [InlineData("\\\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("//UNC/server/folder/myfile.txt")]
+    [InlineData("/\\UNC\\server\\folder\\myfile.txt")]
+    [InlineData("\\/UNC/server/folder/myfile.txt")]
+    public async Task DownloadToFileRejectsUncOrExtendedPathsAsync(string filePath)
+    {
+        // Arrange
+        var uri = new Uri("https://raw.githubusercontent.com/microsoft/semantic-kernel/refs/heads/main/docs/images/sk_logo.png");
+        var folderPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString());
+        var webFileDownload = new WebFileDownloadPlugin()
+        {
+            AllowedDomains = ["raw.githubusercontent.com"],
+            AllowedFolders = [folderPath]
+        };
+
+        // Act & Assert
+        await Assert.ThrowsAsync<ArgumentException>(() => webFileDownload.DownloadToFileAsync(uri, filePath));
+    }
+
     [Fact]
     public async Task DownloadToFileUsesCaseSensitiveAllowListComparisonOnLinuxAsync()
     {

dotnet/src/Plugins/Plugins.Web/WebFileDownloadPlugin.cs

@@ -224,11 +224,10 @@ private static string CanonicalizePath(string path)
         return PathUtilities.GetSafeFullPath(expanded);
     }
 
-    private static bool IsUncOrExtendedPath(string path)
-    {
-        return path.StartsWith("\\\\", StringComparison.OrdinalIgnoreCase) ||
-            path.StartsWith("//", StringComparison.OrdinalIgnoreCase);
-    }
+    private static bool IsUncOrExtendedPath(string path) =>
+        path.Length >= 2 &&
+        (path[0] is '/' or '\\') &&
+        (path[1] is '/' or '\\');
 
     /// <summary>
     /// If a list of allowed folder has been provided, the folder of the provided filePath is checked
@@ -239,7 +238,7 @@ private bool IsFilePathAllowed(string path)
     {
         Verify.NotNullOrWhiteSpace(path);
 
-        if (path.StartsWith("\\\\", StringComparison.OrdinalIgnoreCase))
+        if (IsUncOrExtendedPath(path))
         {
             throw new ArgumentException("Invalid file path, UNC paths are not supported.", nameof(path));
         }