)]}'
{"id":"openvpn~1736","triplet_id":"openvpn~master~Ib7f9c9ce5ed778190445cc4cfaa8f3cd5d1110bc","project":"openvpn","branch":"master","attention_set":{},"removed_from_attention_set":{"1000003":{"account":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-06-29 12:37:37.000000000","reason":"removed on reply"},"1000002":{"account":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-06-29 15:59:07.000000000","reason":"Change was submitted"},"1000008":{"account":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"last_update":"2026-06-29 15:59:07.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ib7f9c9ce5ed778190445cc4cfaa8f3cd5d1110bc","subject":"win32: fix plugin trusted-dir check prefix bypass","status":"MERGED","created":"2026-06-27 10:28:19.000000000","updated":"2026-06-29 15:59:07.000000000","submitted":"2026-06-29 15:59:07.000000000","submitter":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":4,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1736","meta_rev_id":"1f6f445430407ca17417fcaf8b07976ae1f8a075","_number":1736,"virtual_id_number":1736,"owner":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"value":0,"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"CC":[{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-27 10:28:19.000000000","updated_by":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-06-27 10:28:19.000000000","updated_by":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"reviewer":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-06-29 08:40:17.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"CC"}],"messages":[{"id":"99f86178cbf41d2de23eedfeade200ca50c2cbe6","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"date":"2026-06-27 10:28:19.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"a88c4e9a129634a83368d0b0323483eb2c4925b3","author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-06-27 10:36:45.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"ace09c35eed4dce2225eded54eb162b066df34df","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-06-29 08:40:17.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"b619301d1eb3921db636b5e73af87b2812ebcfb3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"date":"2026-06-29 12:26:49.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review-1 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":2},{"id":"d00be6a35ad3bd73465c0a227117d268f4e79694","author":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"date":"2026-06-29 12:27:00.000000000","message":"Patch Set 2:\n\n(2 comments)","accounts_in_message":[],"_revision_number":2},{"id":"45b14ddbd3d3fcb4b7c23648596ebd2aa765b6d5","author":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-06-29 12:37:37.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"1f6f445430407ca17417fcaf8b07976ae1f8a075","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-06-29 15:59:07.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"c553bb511f074b27334d54a1ce2d4d0c03a9d3e0","revisions":{"e0ba79507431a8c970b721cd1413d32c64c15415":{"kind":"REWORK","_number":1,"created":"2026-06-27 10:28:19.000000000","uploader":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"ref":"refs/changes/36/1736/1","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/36/1736/1","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1 \u0026\u0026 git checkout -b change-1736 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"712f3d61488a47e80577112489e9e9f98a32aac6","subject":"Make get_random return int64 instead of long"}],"author":{"name":"Lev Stipakov","email":"lev@openvpn.net","date":"2026-06-27 10:24:46.000000000","tz":180},"committer":{"name":"Lev Stipakov","email":"lev@openvpn.net","date":"2026-06-27 10:25:35.000000000","tz":180},"subject":"win32: fix plugin trusted-dir check prefix bypass","message":"win32: fix plugin trusted-dir check prefix bypass\n\nplugin_in_trusted_dir() validated the plugin path against the trusted\nplugin/install directory (and the system directory fallback) using a raw\nstring prefix match via wcsnicmp(). When the trusted directory path does\nnot end in a separator (e.g. the plugin_dir registry value is set to\n\"C:\\openvpn_plugins\"), a sibling directory sharing the same prefix\n(\"C:\\openvpn_plugins_evil\") also passes the check, allowing a plugin to\nbe loaded from outside the allow-listed directory.\n\nIntroduce win_path_in_dir() in win32-util.c which performs the prefix\nmatch but additionally requires the match to end on a path-component\nboundary, and use it for both the plugin/install directory and the\nsystem directory checks. Add unit tests in test_misc.c.\n\nChange-Id: Ib7f9c9ce5ed778190445cc4cfaa8f3cd5d1110bc\nSigned-off-by: Lev Stipakov \u003clev@openvpn.net\u003e\n"},"branch":"refs/heads/master"},"d809e5626304963ddaff0a8b8ff1e3a6b2db8c09":{"kind":"REWORK","_number":2,"created":"2026-06-29 12:26:49.000000000","uploader":{"_account_id":1000008,"name":"stipa","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"ref":"refs/changes/36/1736/2","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/36/1736/2","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2 \u0026\u0026 git checkout -b change-1736 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"294d5ebb32e632c756290cb7b1de3df29a516154","subject":"openvpnserv: rework ConvertItfDnsDomains and tests"}],"author":{"name":"Lev Stipakov","email":"lev@openvpn.net","date":"2026-06-27 10:24:46.000000000","tz":180},"committer":{"name":"Lev Stipakov","email":"lev@openvpn.net","date":"2026-06-29 12:21:33.000000000","tz":180},"subject":"win32: fix plugin trusted-dir check prefix bypass","message":"win32: fix plugin trusted-dir check prefix bypass\n\nplugin_in_trusted_dir() validated the plugin path against the trusted\nplugin/install directory (and the system directory fallback) using a raw\nstring prefix match via wcsnicmp(). When the trusted directory path does\nnot end in a separator (e.g. the plugin_dir registry value is set to\n\"C:\\openvpn_plugins\"), a sibling directory sharing the same prefix\n(\"C:\\openvpn_plugins_evil\") also passes the check, allowing a plugin to\nbe loaded from outside the allow-listed directory.\n\nIntroduce win_path_in_dir() in win32-util.c which performs the prefix\nmatch but additionally requires the match to end on a path-component\nboundary, and use it for both the plugin/install directory and the\nsystem directory checks. Add unit tests in test_misc.c.\n\nChange-Id: Ib7f9c9ce5ed778190445cc4cfaa8f3cd5d1110bc\nSigned-off-by: Lev Stipakov \u003clev@openvpn.net\u003e\n"},"branch":"refs/heads/master"},"c553bb511f074b27334d54a1ce2d4d0c03a9d3e0":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2026-06-29 15:59:07.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/36/1736/3","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/36/1736/3","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3 \u0026\u0026 git checkout -b change-1736 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/36/1736/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"294d5ebb32e632c756290cb7b1de3df29a516154","subject":"openvpnserv: rework ConvertItfDnsDomains and tests"}],"author":{"name":"Lev Stipakov","email":"lev@openvpn.net","date":"2026-06-29 12:48:34.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-06-29 14:45:50.000000000","tz":120},"subject":"win32: fix plugin trusted-dir check prefix bypass","message":"win32: fix plugin trusted-dir check prefix bypass\n\nplugin_in_trusted_dir() validated the plugin path against the trusted\nplugin/install directory (and the system directory fallback) using a raw\nstring prefix match via wcsnicmp(). When the trusted directory path does\nnot end in a separator (e.g. the plugin_dir registry value is set to\n\"C:\\openvpn_plugins\"), a sibling directory sharing the same prefix\n(\"C:\\openvpn_plugins_evil\") also passes the check, allowing a plugin to\nbe loaded from outside the allow-listed directory.\n\nIntroduce win_path_in_dir() in win32-util.c which performs the prefix\nmatch but additionally requires the match to end on a path-component\nboundary, and use it for both the plugin/install directory and the\nsystem directory checks. Add unit tests in test_misc.c.\n\nChange-Id: Ib7f9c9ce5ed778190445cc4cfaa8f3cd5d1110bc\nReported-By: 章鱼哥 (@AiPy) (www.aipyaipy.com)\nGithub: OpenVPN/openvpn-private-issues#120\nReported-by: \u003cgenco@srlabs.de\u003e\nGithub: OpenVPN/openvpn-private-issues#109\nSigned-off-by: Lev Stipakov \u003clev@openvpn.net\u003e\nAcked-by: Arne Schwabe \u003carne-openvpn@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1736\nMessage-Id: \u003c20260629124839.32433-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg37382.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}