Even though the code paths that end in GetSecureOutputDirectoryPath() should not be taken in Tor Browser, we want to avoid any chance that the updater will create files under C:\Program Files (x86) or a similar location. Therefore we will stub out the body of GetSecureOutputDirectoryPath() and have it return an error.
Designs
Child items
...
Show closed items
Linked items
0
Link issues together to show that they're related.
Learn more.
Trac: Description: Even though the code paths that end in GetSecureOutputDirectoryPath() should not be taken in Tor Browser, want to avoid any chance that the updater will create files under C:\Program Files (x86) or a similar location. Therefore we will stub out the body of GetSecureOutputDirectoryPath() and have it return an error.
to
Even though the code paths that end in GetSecureOutputDirectoryPath() should not be taken in Tor Browser, we want to avoid any chance that the updater will create files under C:\Program Files (x86) or a similar location. Therefore we will stub out the body of GetSecureOutputDirectoryPath() and have it return an error.
This looks good to me and I tested a Windows build which is still working fine. I merged your patch to tor-browser-68.3.0esr-9.0-1 (commit acaf3250). Leaving the ticket open for sysrqb to pick up the fix for 9.5a3.