Skip to content

Ensure installer option is gated behind install scope - #1317

Merged
lrandersson merged 1 commit into
conda:mainfrom
lrandersson:dev-ra-add-to-path-fix
Aug 10, 2026
Merged

Ensure installer option is gated behind install scope#1317
lrandersson merged 1 commit into
conda:mainfrom
lrandersson:dev-ra-add-to-path-fix

Conversation

@lrandersson

@lrandersson lrandersson commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Description

I noticed the option to add to path is not gated behind the install scope, and it is not possible to hide an installer option for MSI installers thus this option is displayed even when installing for "All Users".

Checklist - did you ...

  • Add a file to the news directory (using the template) for the next release's release notes?
  • Add / update necessary tests?
  • Add / update outdated documentation?

@lrandersson lrandersson self-assigned this Aug 6, 2026
@lrandersson
lrandersson requested a review from a team as a code owner August 6, 2026 20:27
@github-project-automation github-project-automation Bot moved this to 🆕 New in 🔎 Review Aug 6, 2026
@lrandersson
lrandersson force-pushed the dev-ra-add-to-path-fix branch from a6a0389 to ce80489 Compare August 7, 2026 12:51
@conda-bot conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label Aug 7, 2026
marcoesters
marcoesters reviewed Aug 7, 2026
View reviewed changes

@marcoesters marcoesters left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be disclosed in the option description, too.

Even though I wonder if this is even necessary. CVE-2022-26526, which this restriction is based on, has two components: the directory is added to PATH and is world-writable. The latter is the actual attack vector, not adding to PATH.

We can add this to be consistent, but I don't think this is 100% necessary.

@lrandersson

lrandersson commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

This should be disclosed in the option description, too.

Even though I wonder if this is even necessary. CVE-2022-26526, which this restriction is based on, has two components: the directory is added to PATH and is world-writable. The latter is the actual attack vector, not adding to PATH.

We can add this to be consistent, but I don't think this is 100% necessary.

@marcoesters
That's fair. I actually only created this PR because from internal testing the question came up "what happens if I do this?" and I just expect there will be some unexpected failure. This ticket has also been created recently to see if it can be handled in a better way beeware/briefcase#2986.

@lrandersson
lrandersson force-pushed the dev-ra-add-to-path-fix branch from ce80489 to 10ff04d Compare August 7, 2026 20:30
@github-project-automation github-project-automation Bot moved this from 🆕 New to ✅ Approved in 🔎 Review Aug 10, 2026
@lrandersson
lrandersson merged commit 1d3542a into conda:main Aug 10, 2026
44 checks passed
@github-project-automation github-project-automation Bot moved this from ✅ Approved to 🏁 Done in 🔎 Review Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcoesters marcoesters marcoesters approved these changes

Assignees

@lrandersson lrandersson

Labels

cla-signed [bot] added once the contributor has signed the CLA

Projects

🔎 Review
Status: 🏁 Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lrandersson @marcoesters @conda-bot