A mirror of https://github.com/wixtoolset/wix.git https://git.lua4.win/wix/atom?h=v4.0.5 2024-03-22T21:25:14+00:00 2024-03-22T21:25:14+00:00 Rob Mensching rob@firegiant.com 2024-03-22T20:51:59+00:00 urn:sha1:b9b2f1b4c69a1b509d487dc950b30b4ec9b0d040 2024-03-22T21:25:14+00:00 Rob Mensching rob@firegiant.com 2024-03-22T21:24:43+00:00 urn:sha1:ec9e2678b2051583ea24d8cec29572851f3db105 See issue 8033 for more details 2024-03-22T21:25:14+00:00 Rob Mensching rob@firegiant.com 2024-03-21T06:51:53+00:00 urn:sha1:75a8c75d4e02ea219008dc5af7d03869291d61f7 When running elevated, Burn uses the Windows Temp folder as its working folder to prevent normal processes from tampering with the files. Windows Temp does allow non-elevated processes to write to the folder but they cannot see the files there. Unfortunately, contrary to our belief, non-elevated processes can read the files in Windows Temp by watching for directory changes. This allows a malicious process to lie in wait, watching the Windows Temp folder until a Burn process is launched elevated, then attack the working folder. Mitigate that attack by protecting the working folder to only elevated users. Managed custom actions also fall back to using the Windows Temp folder in some cases and thus can be exposed in a similar fashion as an elevated Burn process. Remove that possibility. 2024-03-22T20:30:34+00:00 Rob Mensching rob@firegiant.com 2024-03-22T18:55:43+00:00 urn:sha1:2e5960b575881567a8807e6b8b9c513138b19742 When deleting directories recursively, an elevated custom action following junctions in a user-writable location could recurse into any directory, including some that you might not want to be deleted. Therefore, avoid recursing into directories that are actually junctions (aka "reparse points"). This applies to: - The RemoveFoldersEx custom action (which doesn't actually do deletions but would instruct elevated MSI to delete on your behalf). - DTF's custom action runner. 2024-03-22T20:29:52+00:00 Rob Mensching rob@firegiant.com 2024-03-22T20:29:52+00:00 urn:sha1:2de6f549981222566638abae7c812bb8e2098841 2024-02-06T22:20:07+00:00 Rob Mensching rob@firegiant.com 2024-02-06T20:06:36+00:00 urn:sha1:a85929822f9932fcb938a8f260555e2476040298 2024-02-06T20:06:10+00:00 Rob Mensching rob@firegiant.com 2024-02-06T20:05:56+00:00 urn:sha1:e30c1b2432726d2d5ba572328f9a3956c5d7389c This will prevent elevated processes from accidentally following a junction from a user-writable directory to a per-machine directory and erroneously deleting the per-machine contents. 2024-02-06T15:57:50+00:00 Bob Arnson bob@firegiant.com 2024-01-24T22:38:55+00:00 urn:sha1:fec38b6461d0551339139a2fe52403a61942adc0 2024-02-06T15:54:28+00:00 Andrzej Wojtas 38528584+avjts@users.noreply.github.com 2024-01-20T11:14:02+00:00 urn:sha1:74ef526a2252f794465b2146c4c32c348284cf91 2024-02-06T15:54:28+00:00 Bob Arnson bob@firegiant.com 2024-01-19T21:53:26+00:00 urn:sha1:b22869018d81b781ae129f650ace78a1ed0530ae