-
Notifications
You must be signed in to change notification settings - Fork 903
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
choco install -y C: deletes all files #341
Comments
Thanks for investigating the reason @bill-long - this will be something to fix quite quickly! |
When attempting to combine paths, do not allow any paths being added to have colon `:` as that will reset the path. This can lead to possibly very bad situations when an incorrect command is sent to choco.
* stable: (GH-341) Do not allow combining paths with colon (spec) don't allow interactive windows in specs (GH-219)(GH-56) Allow PowerShell interaction (spec) Set uninstall base scenario (GH-305) add warning if application not uninstalled Conflicts: src/chocolatey.tests.integration/infrastructure/commands/CommandExecutorSpecs.cs src/chocolatey.tests/infrastructure/filesystem/DotNetFileSystemSpecs.cs src/chocolatey/infrastructure.app/services/ChocolateyPackageService.cs src/chocolatey/infrastructure/commands/CommandExecutor.cs
For posterity, this was discovered based on the LabTech plugin for choco noted https://gitter.im/chocolatey/choco?at=558b84c638e37bf74261d3bd |
That Having that said, I wonder what would have happened if you had done |
Note that there may be a fix if you are affected by this: http://www.squidworks.net/2015/06/labtech-chocolatey-nuget-ii-plugin/#comment-17200 From Ben Perkins:
|
As a further enhancement for GH-341 (270ea94), ensure that package names are not attempting to navigate out of the lib backup directory. A specially crafted package name could cause choco to attempt to delete folders it should not, therefore we need to restrict it to the lib backup folder only. If we find we are no longer in a subdirectory of the backup directory, we should return immediately without attempting to delete anything.
If you run
choco install -y C:
, all files are deleted from the folder where you ran this command.In remove_rollback_directory_if_exists(), the packageName being passed in is "C:":
So rollbackDirectory is now set to "C:". Finally we end up in chocolatey.infrastructure.filesystem.DotNetFileSystem.delete_directory(), with a directoryPath of "C:" and recursive set to true. Then we call:
I'm a little surprised this doesn't actually wipe out everything starting from the root of C: in my tests, but it seems that it hits an exception trying to delete the folder where the command is being run. So maybe the exception saves you if you happen to run this from a subfolder with nothing important in it.
Of course, if you actually run this command from the root of C:, then it makes quite a mess of things.
The text was updated successfully, but these errors were encountered: