Horizontal42/summarum
1
0
Fork 0
mirror of https://github.com/Horizontal42/summarum.git synced 2026-11-10 23:51:59 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: fix arbitrary file read in read_text_file

Browse source 
Ensures the provided path is explicitly allowed by Tauri's scoped filesystem before reading it.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot] 2026-08-09 10:39:42 +00:00
parent c958f30662
commit f41803c1b6
5 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
package-lock.json generated
View file

@ -18,6 +18,7 @@
"@tauri-apps/api": "^2.5.0",
"@tauri-apps/plugin-autostart": "^2.3.0",
"@tauri-apps/plugin-dialog": "^2.7.1",
"@tauri-apps/plugin-fs": "^2.5.1",
"@tauri-apps/plugin-global-shortcut": "^2.2.0",
"@tauri-apps/plugin-opener": "^2.2.0",
"@tauri-apps/plugin-process": "^2.3.1",
@ -1235,6 +1236,15 @@
"@tauri-apps/api": "^2.11.0"
}
},
"node_modules/@tauri-apps/plugin-fs": {
"version": "2.5.1",
"resolved": "https://registry.npmjs.org/@tauri-apps/plugin-fs/-/plugin-fs-2.5.1.tgz",
"integrity": "sha512-9Lz+Jopp6QyeEWhlpkMx4R/+P9HgR+AVAI4vOZhlT8Xaymtz8iVI/Ov984/XTqgJz/5gz5NretqPB/XEMS3NhQ==",
"license": "MIT OR Apache-2.0",
"dependencies": {
"@tauri-apps/api": "^2.11.0"
}
},
"node_modules/@tauri-apps/plugin-global-shortcut": {
"version": "2.3.2",
"resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.2.tgz",

1
package.json
View file

@ -24,6 +24,7 @@
"@tauri-apps/api": "^2.5.0",
"@tauri-apps/plugin-autostart": "^2.3.0",
"@tauri-apps/plugin-dialog": "^2.7.1",
"@tauri-apps/plugin-fs": "^2.5.1",
"@tauri-apps/plugin-global-shortcut": "^2.2.0",
"@tauri-apps/plugin-opener": "^2.2.0",
"@tauri-apps/plugin-process": "^2.3.1",

1
src-tauri/Cargo.lock generated
View file

@ -3735,6 +3735,7 @@ dependencies = [
"tauri-build",
"tauri-plugin-autostart",
"tauri-plugin-dialog",
"tauri-plugin-fs",
"tauri-plugin-global-shortcut",
"tauri-plugin-opener",
"tauri-plugin-process",

1
src-tauri/Cargo.toml
View file

@ -21,6 +21,7 @@ serde_json = "1"
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
chrono = "0.4"
futures = "0.3.32"
tauri-plugin-fs = "2.5.1"
[profile.release]
strip = true

7
src-tauri/src/main.rs
View file

@ -10,6 +10,7 @@ use tauri::menu::{Menu, MenuItem};
use tauri::tray::TrayIconBuilder;
use tauri::{AppHandle, Emitter, Manager, WindowEvent};
use tauri_plugin_dialog::DialogExt;
use tauri_plugin_fs::FsExt;
use tauri_plugin_opener::OpenerExt;
const RATES_TTL_SECS: u64 = 3600;
@ -595,8 +596,11 @@ fn migrate_data_dir(
/// Used by drag&drop: read a calculation/text file from an absolute path.
#[tauri::command]
fn read_text_file(path: String) -> Result<String, String> {
fn read_text_file(app: AppHandle, path: String) -> Result<String, String> {
let p = std::path::PathBuf::from(&path);
if !app.try_fs_scope().map(|scope| scope.is_allowed(&p)).unwrap_or(false) {
return Err("path not authorized".into());
}
let ext = p
.extension()
.and_then(|e| e.to_str())
@ -726,6 +730,7 @@ fn main() {
win.set_focus().ok();
}
}))
.plugin(tauri_plugin_fs::init())
.plugin(tauri_plugin_global_shortcut::Builder::new().build())
.plugin(tauri_plugin_autostart::init(
tauri_plugin_autostart::MacosLauncher::LaunchAgent,