Ensure upgrade action properties are secure.
Bob Arnson committed
Nov 8, 2019 at 14:54 UTC
e29c25090e26c8cca52232d580528840d1161b73
4 files changed
+21
-8
src/WixToolset.Core.WindowsInstaller/Bind/CreateSpecialPropertiesCommand.cs
+4
@@ -51,6 +51,10 @@ namespace WixToolset.Core.WindowsInstaller.Bind
51
.Select(ca => ca.Id.Id);
52
hiddenProperties.UnionWith(hideTargetCustomActions);
53
54
+ // Ensure upgrade action properties are secure.
55
+ var actionProperties = this.Section.Tuples.OfType<UpgradeTuple>().Select(u => u.ActionProperty);
56
+ secureProperties.UnionWith(actionProperties);
57
+
58
if (0 < adminProperties.Count)
59
{
60
var tuple = new PropertyTuple(null, new Identifier(AccessModifier.Private, "AdminProperties"));
src/WixToolset.Core/Compiler_2.cs
-3
@@ -4919,9 +4919,6 @@ namespace WixToolset.Core
4919
4920
this.Core.AddTuple(tuple);
4921
4922
- // Ensure the action property is secure.
4923
- this.AddWixPropertyRow(sourceLineNumbers, new Identifier(AccessModifier.Private, actionProperty), false, true, false);
4924
-
4922
// Ensure that RemoveExistingProducts is authored in InstallExecuteSequence
4923
// if at least one row in Upgrade table lacks the OnlyDetect attribute.
4924
if (!onlyDetect)
src/test/WixToolsetTest.CoreIntegration/MsiFixture.cs
+16
-5
@@ -372,16 +372,27 @@ namespace WixToolsetTest.CoreIntegration
372
373
Assert.Equal(0, result);
374
375
+ var pdbPath = Path.Combine(intermediateFolder, @"bin\test.wixpdb");
376
Assert.True(File.Exists(Path.Combine(intermediateFolder, @"bin\test.msi")));
376
- Assert.True(File.Exists(Path.Combine(intermediateFolder, @"bin\test.wixpdb")));
377
+ Assert.True(File.Exists(pdbPath));
378
Assert.True(File.Exists(Path.Combine(intermediateFolder, @"bin\MsiPackage\test.txt")));
379
379
- var intermediate = Intermediate.Load(Path.Combine(intermediateFolder, @"bin\test.wixpdb"));
380
+ var intermediate = Intermediate.Load(pdbPath);
381
var section = intermediate.Sections.Single();
382
382
- var fileTuple = section.Tuples.OfType<FileTuple>().Single();
383
- Assert.Equal(Path.Combine(folder, @"data\test.txt"), fileTuple[FileTupleFields.Source].AsPath().Path);
384
- Assert.Equal(@"test.txt", fileTuple[FileTupleFields.Source].PreviousValue.AsPath().Path);
383
+ var upgradeTuple = section.Tuples.OfType<UpgradeTuple>().Single();
384
+ Assert.False(upgradeTuple.ExcludeLanguages);
385
+ Assert.True(upgradeTuple.IgnoreRemoveFailures);
386
+ Assert.False(upgradeTuple.VersionMaxInclusive);
387
+ Assert.True(upgradeTuple.VersionMinInclusive);
388
+ Assert.Equal("13.0.0", upgradeTuple.VersionMax);
389
+ Assert.Equal("12.0.0", upgradeTuple.VersionMin);
390
+ Assert.False(upgradeTuple.OnlyDetect);
391
+ Assert.Equal("BLAHBLAHBLAH", upgradeTuple.ActionProperty);
392
+
393
+ var pdb = WindowsInstallerData.Load(pdbPath, suppressVersionCheck: false);
394
+ var secureProperties = pdb.Tables["Property"].Rows.Where(row => row.GetKey() == "SecureCustomProperties").Single();
395
+ Assert.Contains("BLAHBLAHBLAH", secureProperties.FieldAsString(1));
396
}
397
}
398
src/test/WixToolsetTest.CoreIntegration/TestData/ManualUpgrade/Package.wxs
+1
@@ -6,6 +6,7 @@
6
<Upgrade Id="01120000-00E0-0000-0000-0000000FF1CE">
7
<UpgradeVersion ExcludeLanguages="no" IgnoreRemoveFailure="yes" IncludeMaximum="no" IncludeMinimum="yes" Maximum="13.0.0" Minimum="12.0.0" OnlyDetect="no" Property="BLAHBLAHBLAH" />
8
</Upgrade>
9
+ <!--<Property Id="BLAHBLAHBLAH" Secure="yes" />-->
10
11
<InstallExecuteSequence>
12
<RemoveExistingProducts After="InstallValidate" />