| 4110 | } |
| 4111 | |
| 4112 | static bool win_directory_component_secure(win_security_t *security, const wchar_t *path) { |
| 4113 | HANDLE directory = |
| 4114 | CreateFileW(path, FILE_READ_ATTRIBUTES | READ_CONTROL, |
| 4115 | FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, |
| 4116 | FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, NULL); |
| 4117 | if (directory == INVALID_HANDLE_VALUE) { |
| 4118 | return false; |
| 4119 | } |
| 4120 | BY_HANDLE_FILE_INFORMATION info; |
| 4121 | /* Default Windows profile ancestors grant cross-account add-subdirectory. |
| 4122 | * That permits siblings but cannot replace the existing next path |
| 4123 | * component. Keep every other mutation right forbidden; the final runtime |
| 4124 | * directory is separately owner-validated and given a protected DACL. */ |
| 4125 | DWORD mutation = win_private_mutation_rights() & ~((DWORD)FILE_ADD_SUBDIRECTORY); |
| 4126 | bool valid = GetFileInformationByHandle(directory, &info) != 0 && |
| 4127 | (info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 && |
| 4128 | (info.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0 && |
| 4129 | win_file_security_secure(security, directory, false, mutation); |
| 4130 | (void)CloseHandle(directory); |
| 4131 | return valid; |
| 4132 | } |
| 4133 | |
| 4134 | static bool win_private_directory_tree_secure(const wchar_t *directory_path) { |
| 4135 | if (!directory_path) { |
no test coverage detected