Skip to content

Default nsis produced build includes a security vulnerability in the un install exe for windows #9048

Open
@KIvanow

Description

@KIvanow

When using electron-builder with the following config

"win": {
    "target": ["nsis"],
    "artifactName": "Redis-Insight-${os}-installer.${ext}",
    "icon": "resources/icon.ico",
    "publisherName": ["Redis Inc.", "Redis Labs Inc."]
  },
  "nsis": {
    "oneClick": false,
    "perMachine": false,
    "allowToChangeInstallationDirectory": true
  },

When the produced executible is installed on windows, there is also an Uninstall Redis Insight.exe file. The uninstall file is flagged for using a vulnerable api - wsprintfW.

I've tested multiple different configuration options for the windows builds, but they were all including the insecure wsprintfW api. What is it required for? Is there a way for us to create builds without it, or is the root cause in electro-builder itself?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions