latest

Harden Program Files restore against folder-name injection (#3)

Restore.ps1 line 376 derived the system target path directly from the
backup folder name via Replace('+', ' '). Combined with the broad
matching regex (`^Program\+Files`), a backup folder named
`Program+Files+arbitrary` would be restored as administrator to
`C:\Program Files arbitrary`, letting an attacker create arbitrary
admin-owned directories under C:\.

Replace the user-controlled path construction with a whitelist that
maps to one of the two fixed system locations. The unreachable
`elseif ($dir.Name.StartsWith("Program+Files"))` branch (always
shadowed by the preceding `if`) is removed since the safe whitelist
now lives in the primary branch.

https://claude.ai/code/session_01D59dycjW3TJnqNXwue5QC2

Co-authored-by: Claude <noreply@anthropic.com>