Do not follow junctions when recursively deleting directories
This will prevent elevated processes from accidentally following a junction from a user-writable directory to a per-machine directory and erroneously deleting the per-machine contents.
Rob Mensching committed
Feb 6, 2024 at 12:05 UTC
2824298d9dd817a47527c920363556b54ead5d5d
1 file changed
+4
-4
src/libs/dutil/WixToolset.DUtil/dirutil.cpp
+4
-4
@@ -26,7 +26,7 @@
26
27
*******************************************************************/
28
extern "C" BOOL DAPI DirExists(
29
- __in_z LPCWSTR wzPath,
29
+ __in_z LPCWSTR wzPath,
30
__out_opt DWORD *pdwAttributes
31
)
32
{
@@ -73,7 +73,7 @@ extern "C" HRESULT DAPI DirCreateTempPath(
73
74
*******************************************************************/
75
extern "C" HRESULT DAPI DirEnsureExists(
76
- __in_z LPCWSTR wzPath,
76
+ __in_z LPCWSTR wzPath,
77
__in_opt LPSECURITY_ATTRIBUTES psa
78
)
79
{
@@ -203,8 +203,8 @@ extern "C" HRESULT DAPI DirEnsureDeleteEx(
203
}
204
}
205
206
- // If we're deleting files and/or child directories loop through the contents of the directory.
207
- if (fDeleteFiles || fRecurse)
206
+ // If we're deleting files and/or child directories loop through the contents of the directory, but skip junctions.
207
+ if ((fDeleteFiles || fRecurse) && (0 == (dwAttrib & FILE_ATTRIBUTE_REPARSE_POINT)))
208
{
209
if (fScheduleDelete)
210
{