1
0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-02 12:02:47 -05:00

Stop looking for putty.chm alongside the binary.

With this change, we stop expecting to find putty.chm alongside the
executable file. That was a security hazard comparable to DLL
hijacking, because of the risk that a malicious CHM file could be
dropped into the same directory as putty.exe (e.g. if someone ran
PuTTY from their browser's download dir)..

Instead, the standalone putty.exe (and other binaries needing help)
embed the proper CHM file within themselves, as a Windows resource,
and if called on to display the help then they write the file out to a
temporary location. This has the advantage that if you download and
run the standalone putty.exe then you actually _get_ help, which
previously didn't happen!

The versions of the binaries in the installer don't each contain a
copy of the help file; that would be extravagant. Instead, the
installer itself writes a registry entry pointing at the proper help
file, and the executables will look there.

Another effect of this commit is that I've withdrawn support for the
older .HLP format completely. It's now entirely outdated, and
supporting it through this security fix would have been a huge pain.
This commit is contained in:
Simon Tatham
2019-01-26 20:26:09 +00:00
parent 63a58759b5
commit 67d3791de8
14 changed files with 345 additions and 116 deletions

View File

@ -228,6 +228,7 @@ void shutdown_help(void);
bool has_help(void);
void launch_help(HWND hwnd, const char *topic);
void quit_help(HWND hwnd);
int has_embedded_chm(void); /* 1 = yes, 0 = no, -1 = N/A */
/*
* The terminal and logging context are notionally local to the
@ -700,4 +701,7 @@ char *get_jumplist_registry_entries(void);
#define CLIPUI_DEFAULT_MOUSE CLIPUI_EXPLICIT
#define CLIPUI_DEFAULT_INS CLIPUI_EXPLICIT
/* In winmisc.c */
char *registry_get_string(HKEY root, const char *path, const char *leaf);
#endif