gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/tools
History
Exact
Tobias Nießen 10042683c8 msi: do not create AppData\Roaming\npm 
This effectively reverts e431cae7e7 due to
security concerns. The directory is being created with elevated
privileges but its path may depend on an unprivileged user's environment
variables. Creating a directory in certain sensitive locations can cause
Windows to become inoperable.

Creating AppData\Roaming\npm was an intentional addition in order to
resolve https://github.com/nodejs/node-v0.x-archive/issues/8141, which
appears to have been a common issue for users of npm. However, this was
implemented before 4cfe5eb9af, which
changed the MSI installation scope to perMachine. There were concerns
about creating the npm directory in that PR, albeit not related to
security (see https://github.com/nodejs/node-v0.x-archive/pull/25640).

Refs: https://github.com/nodejs/node-v0.x-archive/issues/8141
Refs: https://github.com/nodejs/node-v0.x-archive/pull/8838
Refs: https://github.com/nodejs/node-v0.x-archive/pull/25640
PR-URL: https://github.com/nodejs-private/node-private/pull/408
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/430
Reviewed-By: Rich Trott <rtrott@gmail.com>
CVE-ID: CVE-2023-30585
2023-06-19 15:51:37 -03:00
..
actions tools: update main branch name 2022-07-31 09:44:51 +02:00
bootstrap
clang-format tools: update clang-format 1.7.0 to 1.8.0 2022-07-31 09:44:21 +02:00
code_cache src: disambiguate terms used to refer to builtins and addons 2022-12-08 09:55:24 -05:00
configure.d
dep_checker tools: update undici CPE in vuln checking script 2022-10-11 14:45:11 -05:00
doc test_runner: support programmatically running --test 2022-12-07 09:04:55 -05:00
eslint-rules tools: fix typo in avoid-prototype-pollution lint rule 2022-11-23 12:07:09 -05:00
gyp doc: consolidate use of multiple-byte units 2022-07-31 09:43:51 +02:00
icu doc: update link of ICU data slicer 2022-07-31 09:44:56 +02:00
inspector_protocol doc: consolidate use of multiple-byte units 2022-07-31 09:43:51 +02:00
lint-md tools: update lint-md-dependencies to rollup@2.79.1 2022-10-11 14:45:28 -05:00
macos-installer
msvs msi: do not create AppData\Roaming\npm 2023-06-19 15:51:37 -03:00
node_modules tools: update eslint to 8.24.0 2022-10-11 14:45:28 -05:00
pip
snapshot bootstrap: move embedded snapshot to SnapshotBuilder 2022-07-31 09:43:51 +02:00
v8
v8_gypfiles gyp: libnode for ios app embedding 2022-10-11 14:45:27 -05:00
zos tools: support versioned node shared libs on z/OS 2022-08-01 16:48:27 +02:00
.eslintrc.yaml tools: enable no-var ESLint rule for lib 2022-07-31 09:43:37 +02:00
build-addons.mjs tools: refactor build-addons.js to ESM 2022-07-31 09:44:16 +02:00
certdata.txt tools: update certdata.txt 2022-12-07 09:54:13 -05:00
checkimports.py
compress_json.py doc: consolidate use of multiple-byte units 2022-07-31 09:43:51 +02:00
cpplint.py tools: refloat 7 Node.js patches to cpplint.py 2022-07-31 09:43:22 +02:00
create_android_makefiles
create_expfile.sh
find-inactive-collaborators.mjs tools: add verbose flag to find-inactive-collaborators 2022-10-11 14:45:08 -05:00
find-inactive-tsc.mjs tools: add verbose flag to inactive TSC finder 2022-08-01 16:48:28 +02:00
gen_node_def.cc build: fix various shared library build issues 2022-07-31 09:44:06 +02:00
genv8constants.py
getarch.py
getendian.py
getmachine.py
getmoduleversion.py
getnapibuildversion.py
getnodeversion.py
getsharedopensslhasquic.py
gyp_node.py
install.py build: fix bad upstream merge 2022-11-04 16:25:28 +00:00
js2c.py src: disambiguate terms used to refer to builtins and addons 2022-12-08 09:55:24 -05:00
license-builder.sh tools: make license-builder.sh comply with shellcheck 0.8.0 2022-11-23 12:26:12 -05:00
license2rtf.mjs tools: refactor tools/license2rtf to ESM 2022-07-31 09:45:10 +02:00
lint-pr-url.mjs tools: update main branch name 2022-07-31 09:44:51 +02:00
lint-sh.mjs tools: refactor lint-sh.js to esm module 2022-07-31 09:44:07 +02:00
lsan_suppressions.txt
macos-firewall.sh tools: lint osx shell scripts 2022-07-31 09:43:47 +02:00
make-v8.sh build: use ccache in make-v8.sh on ppc64le and s390x 2022-04-23 22:47:13 -04:00
mk-ca-bundle.pl
mkssldef.py
osx-codesign.sh
osx-entitlements.plist
osx-gon-config.json.tmpl
osx-notarize.sh tools: lint osx shell scripts 2022-07-31 09:43:47 +02:00
osx-pkg-postinstall.sh
osx-productsign.sh
release.sh
run-valgrind.py
run-worker.js
sign.bat
specialize_node_d.py
test-npm-package.js
test-v8.bat
test.py tools: increase timeout of running WPT 2022-10-11 14:45:30 -05:00
update-authors.mjs tools: refactor update-authors.js to ESM 2022-07-31 09:44:15 +02:00
update-cares.sh
update-eslint.sh
update-llhttp.sh tools: add update-llhttp.sh 2022-10-11 14:45:27 -05:00
update-nghttp2.sh tools: fix typo in update-nghttp2.sh 2022-10-11 14:45:26 -05:00
update-npm.sh tools: update main branch name 2022-07-31 09:44:51 +02:00
update-timezone.mjs tools: remove faulty early termination logic from update-timezone.mjs 2022-11-24 11:14:45 -05:00
update-undici.sh deps: update undici to 5.1.1 2022-07-31 09:44:01 +02:00
utils.py tools: make utils.SearchFiles deterministic 2023-03-27 13:01:21 +01:00
valgrind.supp