mirror of
https://github.com/Horizontal42/summarum.git
synced 2026-11-11 01:02:01 +03:00
6c2cd9fda2
Moved the file selection dialog (`tauri-plugin-dialog`) into the Rust backend commands (`write_image_file` and `write_text_file`) instead of having the frontend supply arbitrary raw paths to write to. This ensures that the OS-native dialog handles secure path resolution and prevents potential remote code execution (RCE) via XSS. Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
52 lines
1.5 KiB
Diff
52 lines
1.5 KiB
Diff
--- src-tauri/src/main.rs
|
|
+++ src-tauri/src/main.rs
|
|
@@ -40,40 +40,42 @@
|
|
}
|
|
|
|
#[tauri::command]
|
|
-fn write_text_file(app: AppHandle, contents: String, is_sum: bool) -> Result<(), String> {
|
|
+fn write_text_file(app: AppHandle, contents: String, is_sum: bool) -> Result<bool, String> {
|
|
let (name, ext) = if is_sum {
|
|
("Summarum Sheet", "sum")
|
|
} else {
|
|
("Text file", "txt")
|
|
};
|
|
if let Some(p) = app
|
|
.dialog()
|
|
.file()
|
|
.add_filter(name, &[ext])
|
|
.blocking_save_file()
|
|
{
|
|
write_atomic(&p.into_path().map_err(|e| e.to_string())?, &contents)?;
|
|
+ Ok(true)
|
|
+ } else {
|
|
+ Ok(false)
|
|
}
|
|
- Ok(())
|
|
}
|
|
|
|
#[tauri::command]
|
|
-fn write_image_file(app: AppHandle, data_base64: String) -> Result<(), String> {
|
|
+fn write_image_file(app: AppHandle, data_base64: String) -> Result<bool, String> {
|
|
if let Some(p) = app
|
|
.dialog()
|
|
.file()
|
|
.add_filter("PNG Image", &["png"])
|
|
.blocking_save_file()
|
|
{
|
|
let path = p.into_path().map_err(|e| e.to_string())?;
|
|
use std::io::Write;
|
|
let bytes = base64_decode(&data_base64)?;
|
|
let tmp = path.with_extension("tmp");
|
|
std::fs::File::create(&tmp)
|
|
.and_then(|mut f| f.write_all(&bytes))
|
|
.map_err(|e| e.to_string())?;
|
|
fs::rename(&tmp, path).map_err(|e| e.to_string())?;
|
|
+ Ok(true)
|
|
+ } else {
|
|
+ Ok(false)
|
|
}
|
|
- Ok(())
|
|
}
|
|
|
|
fn base64_decode(s: &str) -> Result<Vec<u8>, String> {
|