aboutsummaryrefslogtreecommitdiff
path: root/src/dtf/SfxCA (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Protect elevated working folder from malicious dataRob Mensching2024-03-221-26/+6
| | | | | | | | | | | | | | | When running elevated, Burn uses the Windows Temp folder as its working folder to prevent normal processes from tampering with the files. Windows Temp does allow non-elevated processes to write to the folder but they cannot see the files there. Unfortunately, contrary to our belief, non-elevated processes can read the files in Windows Temp by watching for directory changes. This allows a malicious process to lie in wait, watching the Windows Temp folder until a Burn process is launched elevated, then attack the working folder. Mitigate that attack by protecting the working folder to only elevated users. Managed custom actions also fall back to using the Windows Temp folder in some cases and thus can be exposed in a similar fashion as an elevated Burn process. Remove that possibility.
* Don't follow junctions when recursing directories.Rob Mensching2024-03-221-1/+3
| | | | | | | | | | | | | | When deleting directories recursively, an elevated custom action following junctions in a user-writable location could recurse into any directory, including some that you might not want to be deleted. Therefore, avoid recursing into directories that are actually junctions (aka "reparse points"). This applies to: - The RemoveFoldersEx custom action (which doesn't actually do deletions but would instruct elevated MSI to delete on your behalf). - DTF's custom action runner.
* Minimize calls into GitInfo by caching results during build_initRob Mensching2022-11-131-1/+0
|
* Provide managed CA and Embedded UI DTF libraries via NuGetRob Mensching2022-03-3116-0/+3436
Lots of refactoring to bring the SFX tooling back into the 'dtf' layer since they are (in the end) tightly coupled to some DTF assemblies. Also refactored the DTF tests into their own folder and added a couple integration tests to build using the new CA/UI NuGet package. Closes wixtoolset/issues#6080