[tor-bugs] #32616 [Applications/Tor Browser]: disable GetSecureOutputDirectoryPath() functionality

Wed Nov 27 01:02:05 UTC 2019

#32616: disable GetSecureOutputDirectoryPath() functionality
----------------------------------------------+----------------------------
 Reporter:  mcs                               |          Owner:  mcs
     Type:  defect                            |         Status:
                                              |  needs_review
 Priority:  Medium                            |      Milestone:
Component:  Applications/Tor Browser          |        Version:
 Severity:  Normal                            |     Resolution:
 Keywords:  tbb-update,TorBrowserTeam201911R  |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+----------------------------
Description changed by mcs:

Old description:

> Even though the code paths that end in `GetSecureOutputDirectoryPath()`
> should not be taken in Tor Browser, want to avoid any chance that the
> updater will create files under `C:\Program Files (x86)` or a similar
> location. Therefore we will stub out the body of
> `GetSecureOutputDirectoryPath()` and have it return an error.

New description:

 Even though the code paths that end in `GetSecureOutputDirectoryPath()`
 should not be taken in Tor Browser, we want to avoid any chance that the
 updater will create files under `C:\Program Files (x86)` or a similar
 location. Therefore we will stub out the body of
 `GetSecureOutputDirectoryPath()` and have it return an error.

--

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/32616#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online