From f41803c1b676ebc7a7c2611c901e24c19b014028 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 10:39:42 +0000
Subject: [PATCH] security: fix arbitrary file read in read_text_file

Ensures the provided path is explicitly allowed by Tauri's scoped filesystem before reading it.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
---
 package-lock.json     | 10 ++++++++++
 package.json          |  1 +
 src-tauri/Cargo.lock  |  1 +
 src-tauri/Cargo.toml  |  1 +
 src-tauri/src/main.rs |  7 ++++++-
 5 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index 00cf865..54a44ca 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,6 +18,7 @@
         "@tauri-apps/api": "^2.5.0",
         "@tauri-apps/plugin-autostart": "^2.3.0",
         "@tauri-apps/plugin-dialog": "^2.7.1",
+        "@tauri-apps/plugin-fs": "^2.5.1",
         "@tauri-apps/plugin-global-shortcut": "^2.2.0",
         "@tauri-apps/plugin-opener": "^2.2.0",
         "@tauri-apps/plugin-process": "^2.3.1",
@@ -1235,6 +1236,15 @@
         "@tauri-apps/api": "^2.11.0"
       }
     },
+    "node_modules/@tauri-apps/plugin-fs": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-fs/-/plugin-fs-2.5.1.tgz",
+      "integrity": "sha512-9Lz+Jopp6QyeEWhlpkMx4R/+P9HgR+AVAI4vOZhlT8Xaymtz8iVI/Ov984/XTqgJz/5gz5NretqPB/XEMS3NhQ==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.11.0"
+      }
+    },
     "node_modules/@tauri-apps/plugin-global-shortcut": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.2.tgz",
diff --git a/package.json b/package.json
index 9081df4..d69933c 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "@tauri-apps/api": "^2.5.0",
     "@tauri-apps/plugin-autostart": "^2.3.0",
     "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-fs": "^2.5.1",
     "@tauri-apps/plugin-global-shortcut": "^2.2.0",
     "@tauri-apps/plugin-opener": "^2.2.0",
     "@tauri-apps/plugin-process": "^2.3.1",
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 281bbeb..bef306e 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -3735,6 +3735,7 @@ dependencies = [
  "tauri-build",
  "tauri-plugin-autostart",
  "tauri-plugin-dialog",
+ "tauri-plugin-fs",
  "tauri-plugin-global-shortcut",
  "tauri-plugin-opener",
  "tauri-plugin-process",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 9fa0b9b..caa5e16 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -21,6 +21,7 @@ serde_json = "1"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 chrono = "0.4"
 futures = "0.3.32"
+tauri-plugin-fs = "2.5.1"
 
 [profile.release]
 strip = true
diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs
index 74c4642..5069ad8 100644
--- a/src-tauri/src/main.rs
+++ b/src-tauri/src/main.rs
@@ -10,6 +10,7 @@ use tauri::menu::{Menu, MenuItem};
 use tauri::tray::TrayIconBuilder;
 use tauri::{AppHandle, Emitter, Manager, WindowEvent};
 use tauri_plugin_dialog::DialogExt;
+use tauri_plugin_fs::FsExt;
 use tauri_plugin_opener::OpenerExt;
 
 const RATES_TTL_SECS: u64 = 3600;
@@ -595,8 +596,11 @@ fn migrate_data_dir(
 
 /// Used by drag&drop: read a calculation/text file from an absolute path.
 #[tauri::command]
-fn read_text_file(path: String) -> Result<String, String> {
+fn read_text_file(app: AppHandle, path: String) -> Result<String, String> {
     let p = std::path::PathBuf::from(&path);
+    if !app.try_fs_scope().map(|scope| scope.is_allowed(&p)).unwrap_or(false) {
+        return Err("path not authorized".into());
+    }
     let ext = p
         .extension()
         .and_then(|e| e.to_str())
@@ -726,6 +730,7 @@ fn main() {
                 win.set_focus().ok();
             }
         }))
+        .plugin(tauri_plugin_fs::init())
         .plugin(tauri_plugin_global_shortcut::Builder::new().build())
         .plugin(tauri_plugin_autostart::init(
             tauri_plugin_autostart::MacosLauncher::LaunchAgent,