Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove rollback should validate it exists in choco install backup directory #387

Closed
ferventcoder opened this issue Aug 19, 2015 · 0 comments
Closed

Remove rollback should validate it exists in choco install backup directory #387

ferventcoder opened this issue Aug 19, 2015 · 0 comments
Assignees
@ferventcoder
Labels
5 - Released Bug Priority_HIGH Security
Milestone
0.9.9.9

Comments

@ferventcoder
Copy link
Member

As a further enhancement for #341, we should ensure that package names are not attempting to navigate out of the lib backup directory. A specially crafted package name could cause choco to attempt to delete folders it should not, therefore we need to restrict it to the lib backup folder only and exit with an error if it does not find that it is accessing that folder. We should also look to disable navigating up with relative path for a package name when combining the package name with the backup folder.
@ferventcoder ferventcoder added this to the 0.9.9.9 milestone Aug 19, 2015
ferventcoder added a commit that referenced this issue Sep 18, 2015
@ferventcoder
(GH-387) Validate before remove rollback folder
bb270cb 
As a further enhancement for GH-341
(270ea94),  ensure that
package names are not attempting to navigate out of the lib backup
directory. A specially crafted package name could cause choco to
attempt to delete folders it should not, therefore we need to restrict
it to the lib backup folder only.

If we find we are no longer in a subdirectory of the backup directory,
we should return immediately without attempting to delete anything.
ferventcoder added a commit that referenced this issue Sep 18, 2015
@ferventcoder
Merge branch 'stable'
675bf1d 
* stable:
  (GH-387) Validate before remove rollback folder
  (GH-349) Ignore PowerShell InitializeDefaultDrives
@ferventcoder ferventcoder self-assigned this Sep 18, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ferventcoder ferventcoder

Labels
5 - Released Bug Priority_HIGH Security
Projects
None yet
Milestone
0.9.9.9
Development

No branches or pull requests
2 participants
@ferventcoder @gep13