Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore

[peterwald]

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Adds centralized filesystem path-segment validation to prevent path traversal in disk-backed evaluation reporting storage components, improving safety when user-controlled names influence on-disk paths.

Changes:

• Introduces PathValidation utility for validating path segments and ensuring resolved paths stay within a configured root.
• Applies validation/containment checks in DiskBasedResultStore and DiskBasedResponseCache.
• Adds unit + integration tests covering valid/invalid segments and traversal attempts.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
test/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting.Tests/DiskBased/PathValidationTests.cs	Adds coverage for path-segment validation, root containment, and traversal rejection in disk-backed components.
src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/CSharp/Utilities/PathValidation.cs	New shared helper to validate path segments and prevent resolved paths from escaping a configured root.
src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/CSharp/Storage/DiskBasedResultStore.cs	Validates inputs and ensures constructed paths remain under the results root to prevent traversal.
src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/CSharp/Storage/DiskBasedResponseCache.cs	Validates scenario/iteration/key segments and ensures cache paths stay within the cache root.

Comments suppressed due to low confidence (1)

test/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting.Tests/DiskBased/PathValidationTests.cs:203

• xUnit async tests should return Task rather than using async void. Using async void can lead to unobserved exceptions and flaky behavior; update the signature to public async Task ....

    [Fact]
    public async void DiskBasedResponseCacheProvider_TraversalInScenarioName_Throws()
    {

---

You can also share your feedback on Copilot code review. Take the survey.

[shyamnamboodiripad]

LGTM modulo comments and edge cases