Skip to content

fix(iis): correct InstallModule32/64 CustomAction ID naming swap#3603

Open
fzipi wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
fzipi:fix/installer-module-action-naming
Open

fix(iis): correct InstallModule32/64 CustomAction ID naming swap#3603
fzipi wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
fzipi:fix/installer-module-action-naming

Conversation

@fzipi

@fzipi fzipi commented Jul 26, 2026

Copy link
Copy Markdown
Collaborator

what

In iis/installer.wxs, within the 64-bit installer path (Win64=yes), the two InstallModule* CustomAction IDs were swapped relative to what they actually install:

  • CustomAction Id="InstallModule32" installed the 64-bit module (System32, /preCondition:"bitness64")
  • CustomAction Id="InstallModule64" installed the 32-bit module (SysWOW64, /preCondition:"bitness32")

This swaps the two IDs (and updates the matching InstallExecuteSequence references) so each ID now matches its actual bitness, in the exact same relative execution order as before.

why

Not a functional bug: both actions run unconditionally on every install and are correctly gated by appcmd's own /preCondition bitness check rather than by the CustomAction ID, and the sequence references already matched their (mis-)named actions consistently. But the naming is misleading to anyone maintaining this file, and inconsistent with the already-correctly-named UninstallModule32/UninstallModule64 pair a few lines below, which don't have this swap.

Rename only — no logic or ordering change. Verified iis/installer.wxs is still well-formed XML (xmllint --noout) and re-checked every remaining InstallModule32/InstallModule64 reference in the file for consistency after the rename.

references

Found while reviewing #3491.

AI Disclosure

Found and fixed with the assistance of Claude Sonnet 5, based on a naming inconsistency I noticed while reviewing PR #3491. Verified by direct inspection of the diff and by checking XML well-formedness; no behavioral change intended or introduced.

In the 64-bit installer (Win64=yes), the CustomAction IDs were swapped
relative to what they actually install: "InstallModule32" installed the
64-bit module (System32, bitness64 precondition) and "InstallModule64"
installed the 32-bit one (SysWOW64, bitness32 precondition).

Not a functional bug: both actions run unconditionally on every install
and are correctly gated by appcmd's own /preCondition bitness check
rather than by the CustomAction ID, and the InstallExecuteSequence
references already matched their (mis-)named actions consistently. But
the naming makes the file misleading to maintain, and inconsistent with
the already-correctly-named UninstallModule32/64 pair.

Rename only, no logic/order change: swap the two CustomAction Ids and
update the matching InstallExecuteSequence "Custom Action" references
so each ID now matches its actual bitness, in the same relative order
as before.

Found while reviewing owasp-modsecurity#3491.

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant