microsoft / microsoft/winget-cli
Better block default sources when policy is disabled
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 26.4k
- Forks
- 1.8k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 15
Description
Brief description of your issue
The default sources are blocked mainly by URL when the policy is set to disabled, but this can be bypassed by several mechanisms via redirection.
The best option that comes to mind is to more deeply inspect the source to see if the actual data matches the default source rather than blocking based on the URL.
Steps to reproduce
Target the current default sources via some form of redirection at your preferred level.
Expected behavior
Still blocked if trying to add the source.
Actual behavior
Not blocked.
Environment
Anything before this was created.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing issue #2029 with a redirected source while the policy is disabled, then trace the WinGet source validation and default-source policy handling. The work is done when redirected attempts to add a default source remain blocked, including mechanisms beyond direct URL matching.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100