Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EXE and DLLs are executed from user temp folder when app is used, after installation #230

Closed
dhssectest opened this issue Nov 26, 2021 · 1 comment
Labels
bug Something isn't working

Comments

@dhssectest
Copy link

Is your feature request related to a problem? Please describe.
Both Program Files installations, and portable executions of CCAe, will launch separate executables and dlls from random user profile temp folders.

Example, regardless of install type, the following files launch:
%OSDRIVE%\USERS\TESTJEREMY\APPDATA\LOCAL\TEMP\1UYULYWOAN3PZNKR6KPYNSRZFXD\COLOUR CONTRAST ANALYSER (CCA).EXE
%OSDRIVE%\USERS\TESTJEREMY\APPDATA\LOCAL\TEMP\1UYULYWOAN3PZNKR6KPYNSRZFXD\FFMPEG.DLL
%OSDRIVE%\USERS\TESTJEREMY\APPDATA\LOCAL\TEMP\1UYULYWOAN3PZNKR6KPYNSRZFXD\LIBEGL.DLL
%OSDRIVE%\USERS\TESTJEREMY\APPDATA\LOCAL\TEMP\1UYULYWOAN3PZNKR6KPYNSRZFXD\LIBGLESV2.DLL

This makes it difficult to whitelist in a corporate environment.

The executable is publisher signed by "O=TPG INTERACTIVE, LLC, L=CLEARWATER, S=FLORIDA, C=US" which is great and easily whitelisted.
However, the .dlls are not, and whitelisting the whole temp folder for .dlls is not a secure best practice.

Describe the solution you'd like
I have not seen any other applications which launch dlls/exes from user temp folder like this.
Only when an application is installed. Is there a need for it to write & execute new .exe/.dlls each time the app is used?
Is it possible for the app to be self-contained?

Describe alternatives you've considered
I can't think of any alternative solutions here.

Thank you

@ferllings ferllings added the bug Something isn't working label Nov 26, 2021
@ferllings
Copy link
Member

Thanks for the info.
I'm working on MacOS and I didn't know that Electron was packaging some additionnal ddls.

It's seems that can be easily fixed with an option in electron-builder: https://stackoverflow.com/questions/69174622/code-signing-dll-files-with-electron-builder

But it might not be neccessary after #229

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants