new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Tauri · Plugins and security · all subjects

security model & trust

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Security vulnerability in fs scope with file dialog and drag-drop

Tauri 1.2.0 includes a security patch for a vulnerability in file dialog and drag-and-drop functionality. Due to incorrect escaping of special characters in paths, it was possible to partially bypass the fs scope definition. The bypass was limited to neighboring files and subfolders of already allowed paths and required the user to select a pre-existing malicious file or directory during file picker dialog combined with adversary-controlled logic. The patch is also available in versions 1.0.7 and 1.1.2.

External API access security feature in 1.3.0

Tauri 1.3.0 introduces a streamlined way for applications to allow external domains access to the Tauri IPC layer. The feature allows specified subdomains to gain remote access to the Tauri IPC with restrictions. Wildcard and glob patterns are not supported in the final implementation. Only trusted subdomains can be configured. Developers must be aware that domain takeover could lead to compromised user devices if domain ownership changes.

dangerousRemoteUrlIpcAccess configuration schema

The security configuration for external API access uses a 'dangerousRemoteUrlIpcAccess' array. Each entry accepts the following properties: windows (array of window names to allow access), domain (the trusted subdomain, e.g. 'trusted.example'), plugins (array of plugin names to allow access), and enableTauriAPI (boolean to enable or disable built-in Tauri API access). Access cannot be scoped to specific paths or files, only to trusted subdomains.

dangerousRemoteUrlIpcAccess example configuration

Example configuration for allowing remote IPC access: ```json "security": { "dangerousRemoteUrlIpcAccess": [ { "windows": ["main", "settings"], "domain": "trusted.example", "plugins": ["trusted-plugin"], "enableTauriAPI": false }, ], } ```

Browser arguments security issue and resolution in 1.3.0

Tauri 1.3.0 addresses a security issue where the 'additional_browser_args' feature was exposed to the frontend in the window endpoint, allowing potential privilege escalation on Windows. An adversary with window creation capabilities could use command-line arguments to escape Tauri sandboxing and the webview, enabling dangerous features like loading profiles outside the default folder or disabling security measurements such as certificate validation and sandboxing. The feature was changed to be exposed only on the Rust side, allowing developers to implement custom commands for window creation with use-case specific arguments.

ZipSlip vulnerability fix in 1.3.0

Tauri 1.3.0 fixes a potential ZipSlip vulnerability in the bundler where remote bundler files like the Webview2 installer were being extracted. The extraction method was changed from using ZipFile::name() to ZipFile::enclosed_name() to prevent malicious zip files with path traversal sequences like '../../../../foo.sh' from extracting files outside the intended directory. The impact was low because the function only processed verified and trusted files.

Bundler handlebars escaping fix in 1.3.0

Tauri 1.3.0 fixes a bundler hardening issue where content passed to handlebars::Handlebars::render() was not being escaped, which could cause unwanted code execution during the bundler phase. The impact was low but was promptly fixed.

Tauri 1.3.0 security audit

Tauri 1.3.0 underwent an internal security audit performed by tweidinger and chippers from the Tauri project, conducted during paid time at CrabNebula. The audit manually reviewed over 45 pull requests and investigated security implications, external resources including RFC6068, RFC3966, and NSIS documentation.

Security advisory for semi-known IPC exposure vulnerability

Before Tauri 1.3.0, a semi-known vulnerability existed that was being misused by application developers to achieve external domain access to the Tauri IPC layer. Tauri published a security advisory (GHSA-4wm2-cwcf-wwvp) to make the community aware. Applications allowing arbitrary domain navigation or with open redirect vulnerabilities were affected and should update to 1.3.0 as soon as possible.

Tauri 1.4.0 security audit findings

The internal security audit for Tauri 1.4.0 resulted in one impactful issue (CVE-2023-34460) discovered after the official release, which was fixed in a security patch release. The audit was performed by Tillmann and Chip from CrabNebula Ltd and manually reviewed a selection of PRs labeled for security review rather than all PRs.

Give your agent this brain