Skip to content

Commit ac2e6a2

Browse files
authored
fix: verify LiteralPath of update file during windows signature verification (#8295)
1 parent 4a4023c commit ac2e6a2

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

.changeset/nervous-carrots-begin.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"electron-updater": patch
3+
---
4+
5+
fix: verify LiteralPath of update file during windows signature verification

packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { parseDn } from "builder-util-runtime"
22
import { execFile, execFileSync } from "child_process"
33
import * as os from "os"
44
import { Logger } from "./main"
5+
import * as path from "path"
56

67
// $certificateInfo = (Get-AuthenticodeSignature 'xxx\yyy.exe'
78
// | where {$_.Status.Equals([System.Management.Automation.SignatureStatus]::Valid) -and $_.SignerCertificate.Subject.Contains("CN=siemens.com")})
@@ -48,6 +49,18 @@ export function verifySignature(publisherNames: Array<string>, unescapedTempUpda
4849
}
4950
const data = parseOut(stdout)
5051
if (data.Status === 0) {
52+
try {
53+
const normlaizedUpdateFilePath = path.normalize(data.Path)
54+
const normalizedTempUpdateFile = path.normalize(unescapedTempUpdateFile)
55+
logger.info(`LiteralPath: ${normlaizedUpdateFilePath}. Update Path: ${normalizedTempUpdateFile}`)
56+
if (normlaizedUpdateFilePath !== normalizedTempUpdateFile) {
57+
handleError(logger, new Error(`LiteralPath of ${normlaizedUpdateFilePath} is different than ${normalizedTempUpdateFile}`), stderr, reject)
58+
resolve(null)
59+
return
60+
}
61+
} catch (error: any) {
62+
logger.warn(`Unable to verify LiteralPath of update asset due to missing data.Path. Skipping this step of validation. Message: ${error.message ?? error.stack}`)
63+
}
5164
const subject = parseDn(data.SignerCertificate.Subject)
5265
let match = false
5366
for (const name of publisherNames) {
@@ -96,7 +109,6 @@ function parseOut(out: string): any {
96109
// duplicates data.SignerCertificate (contains RawData)
97110
delete signerCertificate.SubjectName
98111
}
99-
delete data.Path
100112
return data
101113
}
102114

0 commit comments

Comments
 (0)