Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
msi: do not create AppData\Roaming\npm
This effectively reverts e431cae due to security concerns. The directory is being created with elevated privileges but its path may depend on an unprivileged user's environment variables. Creating a directory in certain sensitive locations can cause Windows to become inoperable. Creating AppData\Roaming\npm was an intentional addition in order to resolve nodejs/node-v0.x-archive#8141, which appears to have been a common issue for users of npm. However, this was implemented before 4cfe5eb, which changed the MSI installation scope to perMachine. There were concerns about creating the npm directory in that PR, albeit not related to security (see nodejs/node-v0.x-archive#25640). Refs: nodejs/node-v0.x-archive#8141 Refs: nodejs/node-v0.x-archive#8838 Refs: nodejs/node-v0.x-archive#25640 PR-URL: nodejs-private/node-private#408 Backport-PR-URL: nodejs-private/node-private#430 Reviewed-By: Rich Trott <rtrott@gmail.com> CVE-ID: CVE-2023-30585
- Loading branch information