<security label>

@dotnet/msbuild @dsplaisted we should have a discussion on this one of the best path forward. Should we block? Should we buildcheck/warn? Does this have to be done in msbuild land?

@JanKrivanek has already developed a custom build check to track invalid location:
https://github.com/dotutils/BuildChecks/blob/main/src/UntrustedLocationCheck.cs

It's available in this nuget, you can give it a try right away
https://www.nuget.org/packages/DotUtils.BuildChecks/0.0.6-beta

Ooh, very cool. It's already there. Are there plans to add this to the built-in buildchecks?

@JanKrivanek thoughts on including this as a built-in eventually?

Detecting Downloads folder is surprisingly complicated - so I'm not sure we want to have it as a default diagnostic, but a built-in buildcheck sounds fine.
Btw. just opening the project in IDE is same dangerous, however less obvious to users.

More general version of this check is "You are importing logic that is outside of the root of your solution/repository/..."

This is just one of many security footguns that MSBuild can bring - we have a due to openly document those (dotnet/msbuild#10739) - so that we can then start pointing users from such new diagnostics to more comprehensive overview, so that we prevent false sense of security by preventing just some of those (we cannot prevent everything that is dangerous as extensibility points are vital part of MSBuild. Over time I'm hoping to collect more tel around usage of various extensibility points and start flipping the more esoteric ones to explicit opt-in mode)

@JanKrivanek my understanding is that there is already a buildcheck for this. What are the plans to add that included in the built-in ones?

This is not currently planned (other areas of investments are getting precedence in a near future).

But I'll try to find same spare time to copy it to built-in checks - stay tunned :-)

@JanKrivanek buildchecks run after the build has completed? Daniel points out that this would be too late if there were something malicious going on. Could msbuild startup code potentially block this entirely (unless an env is set) and is that something you'd want to consider?