Menu

#206 Windows File collection can recurse on itself

Version 5.10.1
open
nobody
5
2012-02-21
2012-02-21
No

When doing a file collection, with recursion set to "down", and a max_depth of -1, you can get errors evaluating definitions due to Windows 7+ having recursive junction points.

Consider:
<file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="test" version="1" comment=" File path">
<behaviors recurse_direction="down" max_depth="-1"/>
<path datatype="string" operation="equals">C:\</path>
<filename datatype="string" operation="pattern match">^.*$</filename>
</file_object>

On Windows 7/Server 2008, C:\Users\<user>\AppData\Local\Application Data is a junction point back to itself, so when recursing this directory you eventually end up getting an error (you technically exceed the max path length) - it might be desirable to detect this recursion and not follow self-referencing junctions

Discussion


Log in to post a comment.

MongoDB Logo MongoDB