From a52790cba097d20c246645827397ffc19fc2e7d9 Mon Sep 17 00:00:00 2001
From: AkshayK <iit.akshay@gmail.com>
Date: Fri, 11 Jun 2021 15:04:03 -0400
Subject: [PATCH] win,msi: set install directory permission

Explicitly set permission for Windows install directory.

CVE-ID: CVE-2021-22921
Refs: https://hackerone.com/reports/1211160
PR-URL: https://github.com/nodejs-private/node-private/pull/269
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
---
 tools/msvs/msi/product.wxs | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tools/msvs/msi/product.wxs b/tools/msvs/msi/product.wxs
index f008ea7f9adff7..ce53647a135502 100755
--- a/tools/msvs/msi/product.wxs
+++ b/tools/msvs/msi/product.wxs
@@ -46,6 +46,13 @@
     <Property Id="ApplicationFolderName" Value="nodejs"/>
     <Property Id="WIXUI_INSTALLDIR" Value="INSTALLDIR"/>
 
+    <!-- PropertyRef of the account users for setting InstallDir permission explicitly -->
+    <Property Id="AUTHENTICATED_USERS" Value="Authenticated Users"/>
+
+    <PropertyRef Id="WIX_ACCOUNT_LOCALSYSTEM" />
+    <PropertyRef Id="WIX_ACCOUNT_USERS" />
+    <PropertyRef Id="WIX_ACCOUNT_ADMINISTRATORS" />
+
     <Property Id="INSTALLDIR" Secure="yes">
       <RegistrySearch Id="InstallPathRegistry"
                       Type="raw"
@@ -73,6 +80,7 @@
       <ComponentRef Id="NodeStartMenu"/>
       <ComponentRef Id="AppData" />
       <ComponentRef Id="InstallToolsBat" />
+      <ComponentRef Id="SetInstallDirPermission" />
       <ComponentGroupRef Id="Product.Generated"/>
 
       <Feature Id="NodeEtwSupport"
@@ -93,6 +101,7 @@
       <ComponentRef Id="NpxBashScript"/>
       <ComponentRef Id="NpmConfigurationFile"/>
       <ComponentRef Id="AppData" />
+      <ComponentRef Id="SetInstallDirPermission" />
       <ComponentGroupRef Id="NpmSourceFiles"/>
     </Feature>
 
@@ -169,6 +178,20 @@
       <?endif?>
     </DirectoryRef>
 
+    <DirectoryRef Id="INSTALLDIR">
+      <!-- Create component for setting the install directory permission explicitly -->
+      <Component Id="SetInstallDirPermission" Guid="{EFFC4F74-183A-4237-BBD7-0CAD2B950053}">
+        <CreateFolder>
+          <Permission User="[WIX_ACCOUNT_USERS]" GenericRead="yes" Traverse="yes" GenericExecute="yes" Synchronize="yes"
+                      GenericWrite="no" WriteAttributes="no" WriteExtendedAttributes="no"/>
+          <Permission User="[AUTHENTICATED_USERS]" GenericRead="yes" Traverse="yes" GenericExecute="yes" Synchronize="yes"
+                      GenericWrite="no" WriteAttributes="no" WriteExtendedAttributes="no"/>
+          <Permission User="[WIX_ACCOUNT_ADMINISTRATORS]" GenericAll="yes"/>
+          <Permission User="[WIX_ACCOUNT_LOCALSYSTEM]" GenericAll="yes"/>
+        </CreateFolder>
+      </Component>
+    </DirectoryRef>
+
     <DirectoryRef Id="ApplicationProgramsFolder">
       <Component Id="NodeStartMenu">
         <!-- RegistryValue needed because every Component must have a KeyPath.