Improve nupkg validation in NuGet.Protocol (#7284)

Author: zivkan

src/NuGet.Core/NuGet.Packaging/PackageExtractor.cs

@@ -466,6 +466,8 @@ public static async Task<bool> InstallFromSourceAsync(
 
                                     using (var packageReader = new PackageArchiveReader(nupkgStream))
                                     {
+                                        ValidateExpectedPackage(packageIdentity, packageReader);
+
                                         if (packageSaveMode.HasFlag(PackageSaveMode.Nuspec) || packageSaveMode.HasFlag(PackageSaveMode.Files))
                                         {
                                             telemetry.StartIntervalMeasure();
@@ -588,6 +590,22 @@ await VerifyPackageSignatureAsync(
             }
         }
 
+        private static void ValidateExpectedPackage(PackageIdentity packageIdentity, PackageArchiveReader packageReader)
+        {
+            PackageIdentity actualIdentity = packageReader.GetIdentity();
+            if (!PackageIdentityComparer.Default.Equals(packageIdentity, actualIdentity))
+            {
+                string message = string.Format(
+                    CultureInfo.InvariantCulture,
+                    Strings.ErrorPackageIdentityDoesNotMatch,
+                    packageIdentity.Id,
+                    packageIdentity.Version,
+                    actualIdentity.Id,
+                    actualIdentity.Version);
+                throw new PackagingException(message);
+            }
+        }
+
         /// <summary>
         /// Delete the target directory path and the temp nupkg path in case of a failed extraction.
         /// </summary>
@@ -948,6 +966,7 @@ public static async Task<IEnumerable<string>> CopySatelliteFilesAsync(
             {
                 using (var packageReader = new PackageArchiveReader(nupkgFilePath!))
                 {
+                    ValidateExpectedPackage(packageIdentity, packageReader);
                     return await CopySatelliteFilesAsync(
                         packageReader,
                         packagePathResolver,

src/NuGet.Core/NuGet.Packaging/Strings.Designer.cs

@@ -887,4 +887,8 @@ Valid from:</comment>
 {2}</value>
     <comment>0 is a certificate subject, 1 is a certificate fingerprint, and 2 is a PEM-encoded certificate.</comment>
   </data>
+  <data name="ErrorPackageIdentityDoesNotMatch" xml:space="preserve">
+    <value>Expected package {0} {1}, but got package {2} {3}</value>
+    <comment>0 and 2 are package names, and 1 and 3 are versions numbers.</comment>
+  </data>
 </root>

src/NuGet.Core/NuGet.Packaging/Strings.resx

@@ -183,6 +183,11 @@
         <target state="translated">ID balíčku má prázdnou hodnotu nebo hodnotu null.</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Balíček není podepsaný.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.cs.xlf

@@ -183,6 +183,11 @@
         <target state="translated">NULL oder leere Paket-ID.</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Das Paket ist nicht signiert.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.de.xlf

@@ -183,6 +183,11 @@
         <target state="translated">Id. de paquete vacío o nulo</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">El paquete no está firmado.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.es.xlf

@@ -183,6 +183,11 @@
         <target state="translated">ID de package null ou vide</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Le package n'est pas signé.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.fr.xlf

@@ -183,6 +183,11 @@
         <target state="translated">ID pacchetto null o vuoto</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Il pacchetto non è firmato.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.it.xlf

@@ -184,6 +184,11 @@
         <target state="translated">パッケージ ID が Null または空です</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">パッケージが署名されていません。</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.ja.xlf

@@ -183,6 +183,11 @@
         <target state="translated">패키지 ID가 Null이거나 비어 있습니다.</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">패키지가 서명되어 있지 않습니다.</target>