mirrors/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2026-08-13 13:53:06 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

windows: add DLL-hijacking warning;

Browse source 
famously, windows prefers cwd when resolving a binary to execute,
rather than a predefined PATH like linux / unix / every other OS

even worse, it also does this for DLLs, and mitigating *that*
is infeasible because it depends on variables we dont control

print a warning in case someone is unaware of this
This commit is contained in:
ed 2026-07-27 17:15:00 +00:00
parent c70dc7ac56
commit bb40804f2d
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
copyparty/authsrv.py
View file

@ -3059,6 +3059,8 @@ class AuthSrv(object):
zv, _ = vfs.get("", "*", False, True, err=999) zv, _ = vfs.get("", "*", False, True, err=999)
if self.warn_anonwrite and verbosity > 4 and os.getcwd() == zv.realpath: if self.warn_anonwrite and verbosity > 4 and os.getcwd() == zv.realpath:
t = "anyone can write to the current directory: {}\n" t = "anyone can write to the current directory: {}\n"
if ANYWIN:
t += "/!\\ NOTE: because you are using Windows, this is extra dangerous (DLL-hijacking)\n"
self.log(t.format(zv.realpath), c=1) self.log(t.format(zv.realpath), c=1)
self.warn_anonwrite = False self.warn_anonwrite = False