microsoft / MSBuildLocator

An API to locate MSBuild assemblies from an installed Visual Studio location. Use this to ensure that calling the MSBuild API will use the same toolset that a build from Visual Studio or msbuild.exe would.
Other
212 stars 83 forks source link

DotNetSdkLocationHelper does not validate symlink target exists #201

Closed elinor-fung closed 11 months ago

elinor-fung commented 1 year ago

DotNetSdkLocationHelper looks for dotnet on the user's PATH. On non-Windows, it uses realpath to resolve symlinks, but does not check that the target exists.

https://github.com/microsoft/MSBuildLocator/blob/d563efd188ea5786f85bf272470cf7cd4dac9500/src/MSBuildLocator/DotNetSdkLocationHelper.cs#L95-L113

This can end up passing a directory to hostfxr_resolve_sdk2 that does not represent a .NET install, resulting in no SDKs being found.

See https://github.com/dotnet/runtime/issues/83469