security: fix arbitrary file read in read_text_file

Ensures the provided path is explicitly allowed by Tauri's scoped filesystem before reading it.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>

package-lock.json

@@ -18,6 +18,7 @@
         "@tauri-apps/api": "^2.5.0",
         "@tauri-apps/plugin-autostart": "^2.3.0",
         "@tauri-apps/plugin-dialog": "^2.7.1",
+        "@tauri-apps/plugin-fs": "^2.5.1",
         "@tauri-apps/plugin-global-shortcut": "^2.2.0",
         "@tauri-apps/plugin-opener": "^2.2.0",
         "@tauri-apps/plugin-process": "^2.3.1",
@@ -1235,6 +1236,15 @@
         "@tauri-apps/api": "^2.11.0"
       }
     },
+    "node_modules/@tauri-apps/plugin-fs": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-fs/-/plugin-fs-2.5.1.tgz",
+      "integrity": "sha512-9Lz+Jopp6QyeEWhlpkMx4R/+P9HgR+AVAI4vOZhlT8Xaymtz8iVI/Ov984/XTqgJz/5gz5NretqPB/XEMS3NhQ==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.11.0"
+      }
+    },
     "node_modules/@tauri-apps/plugin-global-shortcut": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.2.tgz",

package.json

@@ -24,6 +24,7 @@
     "@tauri-apps/api": "^2.5.0",
     "@tauri-apps/plugin-autostart": "^2.3.0",
     "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-fs": "^2.5.1",
     "@tauri-apps/plugin-global-shortcut": "^2.2.0",
     "@tauri-apps/plugin-opener": "^2.2.0",
     "@tauri-apps/plugin-process": "^2.3.1",

src-tauri/Cargo.lock

@@ -3735,6 +3735,7 @@ dependencies = [
  "tauri-build",
  "tauri-plugin-autostart",
  "tauri-plugin-dialog",
+ "tauri-plugin-fs",
  "tauri-plugin-global-shortcut",
  "tauri-plugin-opener",
  "tauri-plugin-process",

src-tauri/Cargo.toml

@@ -21,6 +21,7 @@ serde_json = "1"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 chrono = "0.4"
 futures = "0.3.32"
+tauri-plugin-fs = "2.5.1"
 
 [profile.release]
 strip = true

src-tauri/src/main.rs

@@ -10,6 +10,7 @@ use tauri::menu::{Menu, MenuItem};
 use tauri::tray::TrayIconBuilder;
 use tauri::{AppHandle, Emitter, Manager, WindowEvent};
 use tauri_plugin_dialog::DialogExt;
+use tauri_plugin_fs::FsExt;
 use tauri_plugin_opener::OpenerExt;
 
 const RATES_TTL_SECS: u64 = 3600;
@@ -595,8 +596,11 @@ fn migrate_data_dir(
 
 /// Used by drag&drop: read a calculation/text file from an absolute path.
 #[tauri::command]
-fn read_text_file(path: String) -> Result<String, String> {
+fn read_text_file(app: AppHandle, path: String) -> Result<String, String> {
     let p = std::path::PathBuf::from(&path);
+    if !app.try_fs_scope().map(|scope| scope.is_allowed(&p)).unwrap_or(false) {
+        return Err("path not authorized".into());
+    }
     let ext = p
         .extension()
         .and_then(|e| e.to_str())
@@ -726,6 +730,7 @@ fn main() {
                 win.set_focus().ok();
             }
         }))
+        .plugin(tauri_plugin_fs::init())
         .plugin(tauri_plugin_global_shortcut::Builder::new().build())
         .plugin(tauri_plugin_autostart::init(
             tauri_plugin_autostart::MacosLauncher::LaunchAgent,