search

radioman / greatmaps

GMap.NET - Great Maps for Windows Forms & Presentation
916 stars 410 forks source link

SQLite dependency is loaded from AppData - possible privilege escalation #70

Open christophvw opened 7 years ago

christophvw commented 7 years ago

SQLite dependency is loaded from AppData folder which will be blocked by AppLocker on our Windows Enterprise Installations.

Loading executable files from user writeable locations is a really bad idea as this could lead to a privilege escalation.

radioman commented 7 years ago

what do you suggest?

christophvw commented 7 years ago

Install the assembly to %ProgramFiles% or GAC/WinSxS

BoGrevyDynatest commented 6 years ago

How about referencing the System.Data.SQLite nuget package, and remove all this loading from AppData?

radioman commented 6 years ago

sqlite is native dll therefore there are 2 versions: x86 and x64, in order to work on AnyCPU loading is required

radioman commented 6 years ago

p.s. you can change cache location https://github.com/radioman/greatmaps/blob/master/GMap.NET.Core/GMap.NET.CacheProviders/SQLitePureImageCache.cs#L140

BoGrevyDynatest commented 6 years ago

When using the System.Data.SQLite nuget package you get both the x86 and x64 version of SQLite.Interop.dll