From 8b7e8a13de29065988913efa068d480b7a656e1a Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Sun, 25 Oct 2026 13:05:31 -0400 Subject: [PATCH] fix(update): the update helper only restarts the app's own executable check_helper accepted any existing file as a standalone install, so a differently named executable passed (the Windows test caught it). The program's name must be one of the app's own. --- crates/update/src/self_update.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crates/update/src/self_update.rs b/crates/update/src/self_update.rs index d7659121..01a4eb22 100644 --- a/crates/update/src/self_update.rs +++ b/crates/update/src/self_update.rs @@ -729,6 +729,10 @@ fn check_helper(app: &App, me: &Path, paths: &Paths, exe: &Path, step: &Finish) return Err(refused()); } let exe = canonical(exe)?; + // Whatever the folder, the program to restart is this app's own, never another executable. + if !exe.file_stem().and_then(|stem| stem.to_str()).is_some_and(|stem| app.stems().any(|id| id.eq_ignore_ascii_case(stem))) { + return Err(refused()); + } let downloads = canonical(&paths.downloads())?; let in_downloads = |file: &Path| canonical(file).map(|f| f.parent() == Some(downloads.as_path())); let allowed = match (detect(app, &exe), step) {