Harden registry backup restore against edited backup files (#135)

Backups live in a folder writable without elevation and are restored
elevated. A key snapshot without Exists read as "did not exist" and the
restore deleted the key; "did not exist" on a key that features only
write values in deleted the whole tree; sub-keys under such a key made
the restore rebuild the parent tree; and data for values Windows runs as
a program was restored unchecked.

Require a Boolean Exists, record per snapshot what a "did not exist"
restore may delete (the feature's values, or the tree for keys a .reg
file deletes outright), reject sub-keys where features capture none,
and require program-start data to match Winnow's own .reg data or be
confirmed in the restore dialog. Automatic rollback now restores from
the in-memory copy instead of re-reading the file.

Author: BiosSystem

.github/workflows/test.yml

@@ -144,6 +144,15 @@ jobs:
             exit 1
           }
 
+      - name: Run registry backup validation tests
+        shell: pwsh
+        run: |
+          $result = Invoke-Pester -Path "Tests/Unit/Test-RegistryBackupValidation.ps1" -Output Detailed -PassThru
+          if ($result.FailedCount -gt 0) {
+            Write-Error "$($result.FailedCount) test(s) failed in Test-RegistryBackupValidation.ps1"
+            exit 1
+          }
+
       - name: Run preset tests
         shell: pwsh
         run: |

CHANGELOG.md

@@ -15,6 +15,14 @@ Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Ve
 - In Spanish, the description under the app removal scope dropdown kept saying apps would be removed for all users and from the Windows image, whichever scope was selected. The description was chosen by matching the dropdown text against English, and that text is translated. It now matches the item's name, and the current-user and target-user descriptions are translated too.
 - Deferred winget uninstalls never ran. The RunOnce entry was `powershell.exe -EncodedCommand` with a Base64 command, 262 to 366 characters for every app in the catalog, and Windows does not run a RunOnce command longer than 260 characters. This affected the sign-in uninstall of user-scope winget apps, `-User` and `-Sysprep` winget removals, and the Edge uninstall scheduled for `-Sysprep`: each was reported as scheduled and then silently skipped. The entry now starts `winget.exe` directly with the app id as one quoted argument (at most 125 characters for the current catalog), and a command that would still be too long is refused instead of written. RunOnce values are not run through a shell, so characters such as `&` in an id stay literal.
 
+### Security
+
+- Restoring a registry backup is stricter about what the file may do. Backups are saved in a folder the user can write without elevation and are restored elevated, so a changed or damaged file could do more than undo Winnow's changes:
+  - A key snapshot without `Exists` was read as "did not exist" and the restore deleted the whole key. `Exists` must now be `true` or `false`.
+  - "Did not exist" on a key that features only write values in (for example `Explorer\Advanced`) deleted the whole key tree. It now removes just those values, and the key only when nothing else is left in it. Keys a feature deletes outright keep the whole-tree restore.
+  - A snapshot could carry sub-keys under a key that features capture without sub-keys, and restoring it rebuilt the whole tree. That is now rejected.
+  - Values Windows runs as a program (shell `open\command` verbs, `RunOnce`, COM server and context menu handler registrations) had their data restored as is. Their data must now match what Winnow's own .reg files write; anything else is listed in a warning and restored only if the user confirms it. Automatic rollback after a failed apply restores from the copy held in memory instead of re-reading the file.
+
 ## [4.4.4] - 2026-10-17
 
 ### Fixed

Scripts/Features/BackupRegistryState.ps1

@@ -41,6 +41,10 @@ function New-RegistrySettingsBackup {
         throw "Failed to save registry backup to '$backupFilePath'"
     }
 
+    # Automatic rollback restores from this copy, not from the file: the Backups
+    # folder is writable without elevation, and the restore runs elevated.
+    $script:RunRegistryBackupPayload = $backupConfig
+
     Write-Host "Backup successfully created: $backupFilePath"
     Write-Host ""
 

Scripts/Features/InvokeChanges.ps1

@@ -538,6 +538,7 @@ function Invoke-AllChanges {
                 } | Where-Object { $_ })
                 # Keep the path: it is what automatic rollback restores from if
                 # the apply phase fails.
+                $script:RunRegistryBackupPayload = $null
                 $script:RunRegistryBackupPath = New-RegistrySettingsBackup -ActionableKeys $applyIds -ExtraFeatures $undoSyntheticFeatures
                 if ($applyIds -contains 'RemoveApps') {
                     Write-Host "  [INFO] Backing up Component-Based Servicing hive (HKLM\COMPONENTS)..."
@@ -638,7 +639,14 @@ function Invoke-AllChanges {
             if (-not [string]::IsNullOrWhiteSpace($script:RunRegistryBackupPath)) {
                 Write-Host "> $($script:RunRollbackReason). Rolling back registry changes..." -ForegroundColor Yellow
                 try {
-                    $rollbackBackup = Load-RegistryBackupFromFile -FilePath $script:RunRegistryBackupPath
+                    $rollbackBackup = if ($script:RunRegistryBackupPayload) {
+                        # Same JSON round trip as the file, from this run's memory.
+                        $rollbackSource = $script:RunRegistryBackupPayload | ConvertTo-Json -Depth 25 | ConvertFrom-Json
+                        Normalize-RegistryBackup -Backup $rollbackSource -TrustExecutableValues
+                    }
+                    else {
+                        Load-RegistryBackupFromFile -FilePath $script:RunRegistryBackupPath
+                    }
                     $rollbackResult = Restore-RegistryBackupState -Backup $rollbackBackup
                     if ($rollbackResult -and $rollbackResult.Result) {
                         $registryOutcome = $true