win,msi: use localized "Authenticated Users" name #39241
Conversation
github-actions
bot
added
install
|
(For @nodejs/releasers, test build: https://ci-release.nodejs.org/job/iojs+release/7003/ ) |
|
Test installers
For anyone testing these please remember that Node.js installers do not allow multiple installations (I don't know the reasoning behind this) so running these installers will replace any version previously installed via installer. Since the updates are one way the only way to go back down to a release installer after installing these would be to completely uninstall first. Having said that, if you are in a position to test these installers on a non-English locale please do so and feed back if they fix the issue in #39224. Bonus points if you can also verify the permissions of the installed directory as per https://hackerone.com/reports/1211160 (which is the security issue e817ba7 addressed). I'm probably not going to be around much over the weekend, but if feedback to the test builds is positive we can probably spin out quick fix releases on Monday/Tuesday. |
|
It should be possible to test it in isolation using the Windows Sandbox feature. I'll try on mine, it's localized in French |
|
I confirm that the install fails with v16.4.1 and works with the test build in a French sandbox. unrelated issueHowever, I tried to use npm, and that doesn't work well: The command never ends. It works fine with v16.4.0 in the same environment. |
This comment has been minimized.
This comment has been minimized.
|
Just ran some tests and this does indeed fix #39224. Installer no longer breaks, and I see the correct permissions are applied to the install directory. The approach taken in the diff looks correct to me. (Note, I'm not sure |
|
Thanks @targos and @DvdGiessen! I've pushed an update to switch to |
Just installed it on Windows 10 Home Edition, version 20H2, 64 bit, German language / locale. This seems to fix #39224. |
Explicitly set permission for Windows install directory. CVE-ID: CVE-2021-22921 Refs: https://hackerone.com/reports/1211160 PR-URL: nodejs-private/node-private#269 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: nodejs#39241 Fixes: nodejs#39224 Refs: nodejs@e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
|
Landed in e9cf120 |
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: nodejs#39241 Fixes: nodejs#39224 Refs: nodejs@e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: #39241 Fixes: #39224 Refs: e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: #39241 Fixes: #39224 Refs: e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: nodejs#39241 Fixes: nodejs#39224 Refs: nodejs@e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
|
j |
Well known user account names are localized on Windows. Look up the "Authenticated Users" user by its security identifier to get the localized name. PR-URL: nodejs#39241 Fixes: nodejs#39224 Refs: nodejs@e817ba7 Refs: https://hackerone.com/reports/1211160 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Well known user account names are localized on Windows. Look up the
"Authenticated Users" user by its security identifier to get the
localized name.
Refs: e817ba7
Refs: https://hackerone.com/reports/1211160
Fixes: #39224
cc @kumarak @nodejs/platform-windows
I think this will work, but I'm running on English Windows 10 so wasn't seeing the error reported on non-English locales. I'm going to build a test build so people can try out the installer.