Electron-builder: NSIS: Uninstall via RMDir /r $INSTDIR is not safe

[nikku]

The NSIS uninstaller uses RMDir /r $INSTDIR to remove the installation directory.

As mentioned in the NSIS documentation it is not a safe command to execute. The reason is that people may accidentally install the application in the Program Files directory and wipe the whole directory, including all installed programs, on uninstall.

Another issue is that this approach is not friendly towards app directory customization: People may add additional config files and folders local to the installation. Upon update these files are removed along with the whole installation directory.

We could improve the uninstaller to only remove installed files to improve the situation.

[nikku]

I could work on integrating the remove only installed files feature if you see a chance to merge the changes.

[develar]

Because you should not touch installation dir. App data should be in dir
that electron app API returns.

So, sorry, but current behavior implemented so by intention.

On Thu, Aug 2, 2018, 09:03 Nico Rehwaldt [e-mail] wrote:

I could work on integrating the remove only installed files feature
http://nsis.sourceforge.net/Uninstall_only_installed_files if you see a
chance to merge the changes.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/electron-userland/electron-builder/issues/3201#issuecomment-409827409,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAVZ3vQrnIjlI34gOkpM1KfDK9IfEvOnks5uMqQsgaJpZM4VrvN4
.

[nikku]

Did you checkout my previous hint regarding the safety of RMDir -r $INSTDIR?

As mentioned in the NSIS documentation it is not a safe command to execute. The reason is that people may accidentally install the application in the Program Files directory and wipe the whole directory, including all installed programs, on uninstall.

People may accidentally delete bigger parts of their system given how the current implementation works.

[develar]

No, you cannot install to Program Files or to another such dir. Because even if you will allow to choose installation dir, you cannot select any dir. Please see https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/templates/nsis/assistedInstaller.nsh#L45

[nikku]

Thanks for the clarification.

[nikku]

Closing this issue, as there is no actual bug.

I'll attempt to implement the remove only installed files feature as a custom NSIS script, then.

[develar]

@nikku Please do not waste your time. Bitte explain why do you still want "remove only installed files". And keep in mind that it is important from a security perspective — each install guaranties you that installation dir contains exactly what installer has.

[nikku]

Users of my application are able to extend it via plugins. These plugins are put in a special folder within the $INSTDIR (this happens in an additional installation step). Along with an per machine installation this allows our customers to (1) pre-configure the app with plugins that are made available for all users on the machine and (2) limit the extend in which a single user may carry out additional extensions.

I'm aware that this is not some every day use case for simple apps. Because of that I'm happy to dig into the issue myself and not waste your time.