Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent access to parent directories from relativeFilePath for archive install #2342

Merged
merged 10 commits into from
Jul 20, 2022
Merged

Prevent access to parent directories from relativeFilePath for archive install #2342

merged 10 commits into from
Jul 20, 2022

Conversation

ryfu-msft
Copy link
Contributor

@ryfu-msft ryfu-msft commented Jul 15, 2022 •
edited by ghost
Loading

Fixes a security issue where the relativeFilePath could be exploited to execute files outside of the directory containing the installer.

Examples: (../../relativeFilePath)

Changes:

  • Adds checks prior to executing the install to verify that the metadata for NestedInstallerfiles is valid
  • Shows appropriate error message to user if checks fail.
    Test:
  • Unit test for verifying relativefilePath with escape string
  • Unit test for verifying if no NestedInstallers are specified.
Microsoft Reviewers: Open in CodeFlow

@ryfu-msft ryfu-msft requested a review from a team as a code owner July 15, 2022 18:24
@ryfu-msft ryfu-msft changed the title Check for escape string in relativeFilePath for archive install Check for parent directory escape string in relativeFilePath for archive install Jul 15, 2022
@ryfu-msft ryfu-msft changed the title Check for parent directory escape string in relativeFilePath for archive install Prevent access to parent directories from relativeFilePath for archive install Jul 15, 2022
@ryfu-msft ryfu-msft requested a review from yao-msft July 18, 2022 21:13
JohnMcPMS
JohnMcPMS requested changes Jul 20, 2022
View reviewed changes
src/AppInstallerCommonCore/Filesystem.cpp Outdated Show resolved Hide resolved
src/AppInstallerCommonCore/Filesystem.cpp Outdated Show resolved Hide resolved
src/AppInstallerCommonCore/Filesystem.cpp Outdated Show resolved Hide resolved
src/AppInstallerCLICore/Workflows/ArchiveFlow.cpp Outdated Show resolved Hide resolved
@ghost ghost added the Needs-Author-Feedback Issue needs attention from issue or PR author label Jul 20, 2022
@ghost ghost removed the Needs-Author-Feedback Issue needs attention from issue or PR author label Jul 20, 2022
JohnMcPMS
JohnMcPMS requested changes Jul 20, 2022
View reviewed changes
src/AppInstallerCLITests/Filesystem.cpp Outdated Show resolved Hide resolved
src/AppInstallerCommonCore/Filesystem.cpp Outdated Show resolved Hide resolved
@ghost ghost added the Needs-Author-Feedback Issue needs attention from issue or PR author label Jul 20, 2022
@ghost ghost removed the Needs-Author-Feedback Issue needs attention from issue or PR author label Jul 20, 2022
@ryfu-msft ryfu-msft merged commit 34f22ce into microsoft:master Jul 20, 2022
@ryfu-msft ryfu-msft deleted the fixEscapePathBug branch July 20, 2022 20:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@florelis florelis florelis left review comments

@Trenly Trenly Trenly left review comments

@JohnMcPMS JohnMcPMS JohnMcPMS approved these changes

@yao-msft yao-msft Awaiting requested review from yao-msft

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ryfu-msft @JohnMcPMS @Trenly @florelis @yao-msft