Generate an error or warning when building under the downloads folder

[dsplaisted]

Building a project under the downloads folder is not very safe. This is because of things like Directory.Build.props, which mean that you need to trust all of the parent folders of your source code up to the root. Most browsers will download files to the downloads folder with no additional confirmation when you click a link, so a malicious link could put a Directory.Build.props file in your downloads folder, and then execute code in your build when you subsequently built a project that had been downloaded (or extracted) under the downloads folder.

We should probably fail outright, or at least warn, when trying to build a project under the Downloads folder.

This probably makes sense to be an MSBuild feature. Possibly it should be a BuildCheck, but maybe it should just be built into MSBuild by default before it even tries to start the build.

[Forgind]

<security label>

[marcpopMSFT]

@dotnet/msbuild @dsplaisted we should have a discussion on this one of the best path forward. Should we block? Should we buildcheck/warn? Does this have to be done in msbuild land?

[YuliiaKovalova]

@JanKrivanek has already developed a custom build check to track invalid location:
https://github.com/dotutils/BuildChecks/blob/main/src/UntrustedLocationCheck.cs

It's available in this nuget, you can give it a try right away
https://www.nuget.org/packages/DotUtils.BuildChecks/0.0.6-beta

[marcpopMSFT]

Ooh, very cool. It's already there. Are there plans to add this to the built-in buildchecks?