Skip to content

Conversation

@sathish-progress
Copy link
Contributor

This pull request improves the security and reliability of named pipe communication in the lib/train/transports/local.rb transport by enforcing strict pipe ownership checks and handling pipe closure scenarios more gracefully. The main focus is on ensuring only the intended Windows user can access the named pipe and making the PowerShell server more robust.

Description

Security and Access Control:

  • Added a verification step in acquire_pipe to ensure that only the current Windows user can connect to the named pipe. If the pipe is owned by another user, an explicit error is raised to prevent unauthorized access.
  • Modified the PowerShell script in start_pipe_server to explicitly set pipe security, granting full control only to the current user when creating the named pipe.
  • Introduced helper methods current_windows_user and pipe_owned_by_current_user? to reliably determine the current user and verify pipe ownership before connecting.

Reliability Improvements:

  • Updated the PowerShell server loop to detect when the client disconnects (i.e., receives a null input), allowing the server to exit gracefully instead of hanging or throwing errors.
  • Wrapped pipe writing in a try/catch block to handle cases where the client closes the pipe unexpectedly, ensuring the server exits cleanly on System.IO.IOException.

Related Issue

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New content (non-breaking change)
  • Breaking change (a content change which would break existing functionality or processes)

Checklist:

  • I have read the CONTRIBUTING document.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants