@Matt-Brown said in Find / Replace All Behavior Change:

@PeterJones Thank you! Probably my own bone-headed oversight. I know it updated recently and afterwards I noticed the behavior…I’ve never intentionally touched the “wrap around” checkbox. It was unchecked. I appreciate the explanation.

That happens. Glad you figured it out.

(I deleted my intervening post, which was made before your post got approved in the post queue)

I examined the AI proposed submittal very carefully and it exactly described my issue. I trusted it used a form and format acceptable to this forum. I have since discovered the reason for the Ctrl-B behavior. It was because my code had mismatched braces. If you have matching open and close braces, it’s behavior is different… it aligns with the Ctrl-D I experienced with Visual Studio. Now I know.

@SammyBolt said in autoupdater and connection temp.sh:

Regarding the WinGup fix in v8.8.8, Was the temp.sh (or similar) exfiltration vector reported in v8.8.4 possible on a clean, official installation of Notepad++?

The temporary fix prevents the hijacking attempts that redirect to the domain other than github.com. However, it cannot protect against malware that is hosted on github.com.

The full fix will be included in the upcoming version, as mentioned below.

You mentioned the fix landed in v8.8.8, but can you confirm if this vulnerability was introduced specifically in v8.8.4 (due to changes in the updater), or were versions prior to 8.8.4 (like 8.8.2/8.8.3) also susceptible to this specific gup.exe hijacking technique? What about 8.8.5-8.8.7?

We still cannot determine the exact method used by the attacker. But it is not a case of “a vulnerability introduced in version X”.

For users currently running v8.8.4 who want to verify they haven’t been impacted before updating: Aside from monitoring network traffic for temp.sh, are there specific things we can check for, like modifications to the update xml file or other modified files/logs in the program directory?

I do not have complete information to provide specific advice. However, here’s an article from a security expert who appears to have investigated this issue:
https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

My suggestion is download & install v8.8.8 manually from the official website.
The upcoming release v8.8.9 will be available in a few days. In this release the code signing certificates will be verified on the downloaded binary before update installation.
Then please update to v8.8.9, in which the vulnerability is fully addressed.

@mpheath
Thank you very much, adding these lines to the startup.py did indeed solve the problem og not correctly highlighted brackets with modern css selectors!

@PeterJones

Thanks for pointing me to that Github issue. I somewhat researched the topic (using VS code/Electron) repos and added a suggestion there.

The issue, I think, is that instead of using a dedicated shell API, Notepad++ tries to manually launch an Explorer process.

@PeterJones Thanks for your efforts, yes, I think that was the issue.