From 2eb8cf62b1b9d2e903d996e356405e25224932be Mon Sep 17 00:00:00 2001
From: Raul Metsma <raul@metsma.ee>
Date: Mon, 13 Jul 2026 14:57:24 +0300
Subject: [PATCH] Harden macOS uninstall script

WE2-1251

Signed-off-by: Raul Metsma <raul@metsma.ee>
---
 debian/web-eid-firefox.postrm |  3 +++
 install/uninstall.sh          | 31 +++++++++++++++++++++++++------
 install/web-eid.wxs           | 22 ++++++++++++++++++++--
 3 files changed, 48 insertions(+), 8 deletions(-)

diff --git a/debian/web-eid-firefox.postrm b/debian/web-eid-firefox.postrm
index ba91065b..1be86497 100644
--- a/debian/web-eid-firefox.postrm
+++ b/debian/web-eid-firefox.postrm
@@ -11,6 +11,9 @@ if [ ! -f ${POLICIES}/policies.json ]; then
 else
     JQARGS=${POLICIES}/policies.json;
 fi
+# Block the extension so it can't be reinstalled from AMO without the native app, avoiding a
+# dangling, non-functional extension. Reinstalling web-eid-firefox overwrites this back to
+# "normal_installed" (see debian/web-eid-firefox.postinst), so this is not a permanent block.
 jq '.policies.ExtensionSettings["{e68418bc-f2b0-4459-a9ea-3e72b6751b07}"] = {"installation_mode": "blocked"}' ${JQARGS} > ${POLICIES}/policies.tmp
 mv ${POLICIES}/policies.tmp ${POLICIES}/policies.json
 
diff --git a/install/uninstall.sh b/install/uninstall.sh
index 900a1ac6..335aea36 100755
--- a/install/uninstall.sh
+++ b/install/uninstall.sh
@@ -2,12 +2,31 @@
 # SPDX-FileCopyrightText: Estonian Information System Authority
 # SPDX-License-Identifier: MIT
 
+set -euo pipefail
+
+echo "This will remove Web eID and its browser integration files. Administrator" \
+     "privileges are required."
+read -r -p "Continue? [y/N] " confirm
+case "${confirm}" in
+  [yY]|[yY][eE][sS]) ;;
+  *) echo "Aborted."; exit 1 ;;
+esac
+
+# Prompt for the admin password once up front; the sudo calls below reuse this ticket.
+sudo -v
+
 sudo rm -rf \
-  /Applications/Utilities/web-eid.app \
-  /Applications/Utilities/web-eid-safari.app \
-  /Library/Google/Chrome/NativeMessagingHosts/eu.webeid.json \
-  /Library/Application\ Support/Mozilla/NativeMessagingHosts/eu.webeid.json \
-  /Library/Application\ Support/Google/Chrome/External\ Extensions/ncibgoaomkmdpilpocfeponihegamlic.json
+  "/Applications/Utilities/web-eid.app" \
+  "/Applications/web-eid-safari.app" \
+  "/Library/Google/Chrome/NativeMessagingHosts/eu.webeid.json" \
+  "/Library/Application Support/Mozilla/NativeMessagingHosts/eu.webeid.json" \
+  "/Library/Application Support/Google/Chrome/External Extensions/ncibgoaomkmdpilpocfeponihegamlic.json"
+
 PLIST=/Library/Preferences/org.mozilla.firefox.plist
-sudo defaults write ${PLIST} ExtensionSettings \
+# Block the extension so it can't be reinstalled from AMO without the native app, avoiding a
+# dangling, non-functional extension. Reinstalling Web eID overwrites this back to
+# 'normal_installed' (see install/macos-postinstall.in), so this is not a permanent block.
+sudo defaults write "${PLIST}" ExtensionSettings \
   -dict-add "'{e68418bc-f2b0-4459-a9ea-3e72b6751b07}'" "{ 'installation_mode' = 'blocked'; }"
+
+echo "Web eID has been uninstalled."
diff --git a/install/web-eid.wxs b/install/web-eid.wxs
index b7442be0..1ee0e85c 100644
--- a/install/web-eid.wxs
+++ b/install/web-eid.wxs
@@ -67,6 +67,10 @@
         Condition="FIREFOXINSTALL=1 AND NOT REMOVE=&quot;ALL&quot;" />
       <Custom Action="ExtensionSettingsNoInstall" Before="InstallFinalize"
         Condition="FIREFOXINSTALL=0 AND NOT REMOVE=&quot;ALL&quot;" />
+      <!-- ExtensionSettingsRemove blocks the extension so it can't be reinstalled from AMO
+           without the native app, avoiding a dangling, non-functional extension. Reinstalling
+           Web eID runs ExtensionSettingsInstall above, which overwrites this back to allowed, so
+           this is not a permanent block. -->
       <Custom Action="ExtensionSettingsRemove" Before="InstallFinalize"
         Condition="REMOVE=&quot;ALL&quot; AND NOT UPGRADINGPRODUCTCODE" />
     </InstallExecuteSequence>
@@ -114,12 +118,23 @@
         <RegistryValue Root="HKLM" Type="string" Name="update_url"
           Key="SOFTWARE\Google\Chrome\Extensions\ncibgoaomkmdpilpocfeponihegamlic"
           Value="https://clients2.google.com/service/update2/crx" />
-        <!-- Block chrome-token-signing extension to avoid conflicts -->
+        <!-- Block chrome-token-signing extension to avoid conflicts. Chromium's registry policy
+             loader (RegistryDict::ConvertToJSON in registry_dict.cc) only reads list-policy
+             entries whose value NAME is numeric (IsKeyNumeric) - non-numeric names are silently
+             ignored - so this can't be replaced with a collision-free unique string (e.g. a hash
+             of the extension ID) as one might expect. The name must stay a bare number, which
+             means it can theoretically collide with another vendor's installer using the same
+             number under this list; there's no registry-level namespacing for this policy.
+             Worst case on collision is that this entry is silently overwritten/ignored, i.e. the
+             legacy extension isn't blocked - a compatibility nicety, not a security control - so
+             this is accepted as-is rather than solved with a heavier enumerate-and-pick-next-free-
+             slot custom action. -->
         <RegistryValue Root="HKLM" Type="string" Name="56791"
           Key="SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
           Value="ckjefchnfjhjfedoccjbhjpbncimppeg" />
       </Component>
       <Component Id="ChromePolicy" Transitive="yes" Condition="(CHROMEINSTALL = 1 AND CHROMEPOLICY = 1)" Bitness="always32">
+        <!-- Same hardcoded-numeric-name caveat as the Blocklist entry above applies here. -->
         <RegistryValue Root="HKLM" Type="string" Name="56790"
           Key="SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
           Value="ncibgoaomkmdpilpocfeponihegamlic" />
@@ -128,12 +143,15 @@
         <RegistryValue Root="HKLM" Type="string" Name="update_url"
           Key="SOFTWARE\Microsoft\Edge\Extensions\gnmckgbandlkacikdndelhfghdejfido"
           Value="https://edge.microsoft.com/extensionwebstorebase/v1/crx" />
-        <!-- Block chrome-token-signing extension to avoid conflicts -->
+        <!-- Block chrome-token-signing extension to avoid conflicts. Same hardcoded-numeric-name
+             caveat as the Chrome Blocklist entry above applies here (Edge's registry policy
+             loader is Chromium-derived and behaves the same way). -->
         <RegistryValue Root="HKLM" Type="string" Name="56791"
           Key="SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"
           Value="fofaekogmodbjplbmlbmjiglndceaajh" />
       </Component>
       <Component Id="EdgePolicy" Transitive="yes" Condition="(EDGEINSTALL = 1 AND EDGEPOLICY = 1)" Bitness="always32">
+        <!-- Same hardcoded-numeric-name caveat as the Blocklist entries above applies here. -->
         <RegistryValue Root="HKLM" Type="string" Name="56790"
           Key="SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
           Value="gnmckgbandlkacikdndelhfghdejfido" />