Reject unsafe Windows update cache roots

2026-07-16 21:55:57 -04:00
parent f14c0bc37a
commit db7c5f97c0
2 changed files with 12 additions and 1 deletions
@@ -320,7 +320,13 @@ function Assert-SafeUpdateCache($Path) {
    $root = Normalize-PathForCompare ([System.IO.Path]::GetPathRoot($full))
    $homePath = Normalize-PathForCompare $HOME
    $homeCache = Normalize-PathForCompare (Join-Path $HOME ".cache")
-    if ($full -eq $root -or $full -eq $homePath -or $full -eq $homeCache) {
+    $unsafe = $full -eq $root -or $full -eq $homePath -or $full -eq $homeCache
+    if (-not $unsafe -and $env:LOCALAPPDATA) {
+        $localAppData = Normalize-PathForCompare $env:LOCALAPPDATA
+        $localAppDataDosh = Normalize-PathForCompare (Join-Path $env:LOCALAPPDATA "dosh")
+        $unsafe = $full -eq $localAppData -or $full -eq $localAppDataDosh
+    }
+    if ($unsafe) {
        throw "refusing unsafe update cache path: $Path"
    }
    $full