RFC: win,dl: remove cwd from dlopen search path #3857
Conversation
SafeSearch (enabled by default) already moves this near the end of the search list. This flag (added in Windows 8) removes it entirely. This may enhance security of applications that depend on libuv, at the high risk of breaking applications that expected to be able to open libraries by a relative path without a path separator (e.g. just the file name).
vtjnash
changed the title
The build is currently having issues with this, since the header is gated on NTDDI_VERSION >= NTDDI_WIN10_RS1, and it is unclear if it was added then or documented then But however, in further research, I realized that this flag would enable the default behavior of linux and mac (if restrictions are enabled for the process https://developer.apple.com/forums/thread/706437). Therefore I withdraw my recommendation against this, and instead do recommend consideration of this change. |
|
|
|
FWIW, still seems like a good change to me. |
|
It appears the main challenge will be that it was added only 7 years ago, in the first anniversary update to Windows 10 https://en.wikipedia.org/wiki/Windows_10_version_1607 |
| @@ -40,7 +41,8 @@ int uv_dlopen(const char* filename, uv_lib_t* lib) { | |||
| return uv__dlerror(lib, filename, GetLastError()); | |||
| } | |||
|
|
|||
| lib->handle = LoadLibraryExW(filename_w, NULL, LOAD_WITH_ALTERED_SEARCH_PATH); | |||
| flags = LOAD_WITH_ALTERED_SEARCH_PATH | LOAD_LIBRARY_SAFE_CURRENT_DIRS; | |||
There was a problem hiding this comment.
| flags = LOAD_WITH_ALTERED_SEARCH_PATH | LOAD_LIBRARY_SAFE_CURRENT_DIRS; | |
| flags = LOAD_WITH_ALTERED_SEARCH_PATH | /*LOAD_LIBRARY_SAFE_CURRENT_DIRS*/0x2000; |
And retry without the flag if LoadLibraryEx fails with (I assume) ERROR_INVALID_PARAMETER or ERROR_INVALID_FLAGS?
SafeSearch (enabled by default) already moves this near the end of the search list. This flag (added in Windows 8) removes it entirely. This may enhance security of applications that depend on libuv, at the high risk of breaking applications that expected to be able to open libraries by a relative path without a path separator (e.g. just the file name).
I recommend against this, since it would deviate from the behavior of other systems, but opened this for comments, since cpython appear to have recently decided that this was a good idea: python/cpython@2438cdf#diff-cd9132e5234678864807ae34a75c5d4d6b894b31c327a4d3620fbd0c37eec16e