search

objective-see / BlockBlock

BlockBlock provides continual protection by monitoring persistence locations.
GNU General Public License v3.0
619 stars 38 forks source link

Hundreds of alerts when unzipping Xcode #38

Closed ddaddy closed 2 years ago

ddaddy commented 2 years ago

I was installing a new build of Xcode through the Xcodes app when I was suddenly inundated with hundreds of alerts. Only a reboot would clear them. Maybe there should be a keyboard shortcut on the buttons so I could have dismissed them all.

Screenshot 2022-03-10 at 10 45 13

Screenshot 2022-03-10 at 10 51 00 copy

luckman212 commented 2 years ago

Sorry this isn't helpful, but just had to say—that is the craziest thing I've ever seen 😱

ddaddy commented 2 years ago

They just kept coming, fast, across 2 monitors!

kylehickinson commented 2 years ago

I had this too, investigated and realized that it's caused by a regex bug in BlockBlock's daemon and will actually alert for any daemon/agent at any deep path that begins with /Users/{user}/...

The regex in question: ^(\/System|\/Users\/.+|)\/Library\/(LaunchDaemons|LaunchAgents)\/.+\.(?i)plist$

This will match something such as /Users/kyle/Downloads/Library/LaunchDaemons/com.blah.plist because of the .+ in that /Users/ group check. If the goal for BlockBlock is to only check /Users/{name}/Library/LaunchDaemons and /Users/{name}/Library/LaunchAgents then the .+ part of that regex should be changed [^\/]+ instead so that it only checks against a user's home directory. The regex in question would end up being: ^(\/System|\/Users\/[^\/]+|)\/Library\/(LaunchDaemons|LaunchAgents)\/.+\.(?i)plist$

Edit: LoginItems regex is also affected by the same issue