Skip to content

fix: Allow disabling of webinstaller files to avoid confusion with actual installers#6575

Merged
mmaietta merged 4 commits into
electron-userland:masterfrom
devinbinnie:webinstaller_fix
Jan 25, 2022
Merged

fix: Allow disabling of webinstaller files to avoid confusion with actual installers#6575
mmaietta merged 4 commits into
electron-userland:masterfrom
devinbinnie:webinstaller_fix

Conversation

@devinbinnie

Copy link
Copy Markdown
Contributor

This PR allows the disabling of web installer files for electron-updater when it is only expected that a full installer should be downloaded.

This prevents a potential flaw in which an attacker using a webinstaller could serve a package not authorized by the developer to the end-user with malicious code inside.

@changeset-bot

changeset-bot Bot commented Jan 24, 2022

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 233acfc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
electron-updater Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@netlify

netlify Bot commented Jan 24, 2022

Copy link
Copy Markdown

✔️ Deploy Preview for car-park-attendant-cleat-11576 ready!

🔨 Explore the source changes: 233acfc

🔍 Inspect the deploy log: https://app.netlify.com/sites/car-park-attendant-cleat-11576/deploys/61f02f866cebba0008d9dce9

😎 Browse the preview: https://deploy-preview-6575--car-park-attendant-cleat-11576.netlify.app

Comment thread packages/electron-updater/src/AppUpdater.ts
@mmaietta

mmaietta commented Jan 24, 2022

Copy link
Copy Markdown
Collaborator

Please also add a .changeset file for this PR via pnpx changeset. Seems like it should be a major bump if we do default disableWebInstaller to true (completely fine since we're in a v23-alpha so we can include breaking changes)

Comment thread packages/electron-updater/src/NsisUpdater.ts Outdated
@devinbinnie devinbinnie requested a review from mmaietta January 25, 2022 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants