From 318802e700b4dcb2665f69abec96c704814904a2 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 18 Jan 2023 21:45:06 -0300 Subject: [PATCH 1/7] chore(ci): remove package filter --- .github/workflows/publish-hotfix.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/publish-hotfix.yml b/.github/workflows/publish-hotfix.yml index 55a7b5ef176..380c6a7befb 100644 --- a/.github/workflows/publish-hotfix.yml +++ b/.github/workflows/publish-hotfix.yml @@ -46,7 +46,6 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} command: 'version-or-publish' createRelease: true - filterPackages: 'tauri' - name: Trigger cli.js publishing workflow if: | From 309aad7bbf8af77bd712677bce580ca1e32bc977 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 18 Jan 2023 22:04:57 -0300 Subject: [PATCH 2/7] fix(ci): dispatcher for cli.js/cli.rs publish workflow --- .github/workflows/publish-hotfix.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-hotfix.yml b/.github/workflows/publish-hotfix.yml index 380c6a7befb..84ea0c3e2a6 100644 --- a/.github/workflows/publish-hotfix.yml +++ b/.github/workflows/publish-hotfix.yml @@ -53,6 +53,17 @@ jobs: contains(steps.covector.outputs.packagesPublished, 'cli.rs') uses: peter-evans/repository-dispatch@v1 with: - token: ${{ secrets.TAURI_BOT_PAT }} + token: ${{ secrets.ORG_TAURI_BOT_PAT }} repository: tauri-apps/tauri event-type: publish-clijs + inputs: '{"releaseId": "${{ steps.covector.outputs.cli.js-releaseId }}" }' + + - name: Trigger cli.rs publishing workflow + if: | + steps.covector.outputs.successfulPublish == 'true' && + contains(steps.covector.outputs.packagesPublished, 'cli.rs') + uses: peter-evans/repository-dispatch@v1 + with: + token: ${{ secrets.ORG_TAURI_BOT_PAT }} + repository: tauri-apps/tauri + event-type: publish-clirs From ca45fdb01397f0ed527f359f3bf7fc664d04300f Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 18 Jan 2023 22:39:06 -0300 Subject: [PATCH 3/7] update publish-cli-js.yml --- .github/workflows/publish-cli-js.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/publish-cli-js.yml b/.github/workflows/publish-cli-js.yml index 716be5f18b6..481e0af70f0 100644 --- a/.github/workflows/publish-cli-js.yml +++ b/.github/workflows/publish-cli-js.yml @@ -198,7 +198,6 @@ jobs: - host: windows-latest target: x86_64-pc-windows-msvc node: - - '12' - '14' - '16' - '18' @@ -232,7 +231,6 @@ jobs: fail-fast: false matrix: node: - - '12' - '14' - '16' - '18' @@ -270,7 +268,6 @@ jobs: fail-fast: false matrix: node: - - '12' - '14' - '16' - '18' @@ -318,7 +315,6 @@ jobs: fail-fast: false matrix: node: - - '12' - '14' - '16' - '18' @@ -401,4 +397,4 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_TOKEN: ${{ secrets.ORG_NPM_TOKEN }} - RELEASE_ID: ${{ github.event.inputs.releaseId }} + RELEASE_ID: ${{ github.event.client_payload.releaseId || github.event.inputs.releaseId }} From 9c0593c33af52cd9e00ec784d15f63efebdf039c Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 12 Apr 2023 11:56:29 -0300 Subject: [PATCH 4/7] feat(core): block remote URLs from accessing the IPC This was cherry picked from ee71c31fd09cc5427da6d29d37c003a914547696, keeping only the logic to block remote URLs from using the IPC. PR: #5918 --- .changes/remote-urls.md | 7 ++ core/tauri-build/src/static_vcruntime.rs | 2 +- core/tauri-runtime-wry/Cargo.toml | 1 + core/tauri-runtime-wry/src/lib.rs | 17 ++++- core/tauri-runtime/Cargo.toml | 1 + core/tauri-runtime/src/window.rs | 20 ++++-- core/tauri/src/app.rs | 2 +- core/tauri/src/manager.rs | 89 ++++++++++++++---------- core/tauri/src/pattern.rs | 7 +- core/tauri/src/test/mock_runtime.rs | 2 + core/tauri/src/window.rs | 32 ++++++++- examples/api/src-tauri/Cargo.lock | 20 +++--- 12 files changed, 141 insertions(+), 59 deletions(-) create mode 100644 .changes/remote-urls.md diff --git a/.changes/remote-urls.md b/.changes/remote-urls.md new file mode 100644 index 00000000000..71d094cd97a --- /dev/null +++ b/.changes/remote-urls.md @@ -0,0 +1,7 @@ +--- +"tauri": patch +"tauri-runtime": patch +"tauri-runtime-wry": patch +--- + +Block remote URLs from accessing the IPC. diff --git a/core/tauri-build/src/static_vcruntime.rs b/core/tauri-build/src/static_vcruntime.rs index a707ac93272..f079763cb31 100644 --- a/core/tauri-build/src/static_vcruntime.rs +++ b/core/tauri-build/src/static_vcruntime.rs @@ -54,5 +54,5 @@ fn override_msvcrt_lib() { f.write_all(bytes).unwrap(); } // Add the output directory to the native library path. - println!("cargo:rustc-link-search=native={}", out_dir); + println!("cargo:rustc-link-search=native={out_dir}"); } diff --git a/core/tauri-runtime-wry/Cargo.toml b/core/tauri-runtime-wry/Cargo.toml index 54c480e5747..298ed3eef9e 100644 --- a/core/tauri-runtime-wry/Cargo.toml +++ b/core/tauri-runtime-wry/Cargo.toml @@ -19,6 +19,7 @@ tauri-utils = { version = "1.2.1", path = "../tauri-utils" } uuid = { version = "1", features = [ "v4" ] } rand = "0.8" raw-window-handle = "0.5" +url = "2" [target."cfg(windows)".dependencies] webview2-com = "0.19.1" diff --git a/core/tauri-runtime-wry/src/lib.rs b/core/tauri-runtime-wry/src/lib.rs index 81aa7008d77..039e1bfd054 100644 --- a/core/tauri-runtime-wry/src/lib.rs +++ b/core/tauri-runtime-wry/src/lib.rs @@ -37,6 +37,7 @@ use wry::application::platform::windows::{WindowBuilderExtWindows, WindowExtWind #[cfg(target_os = "macos")] use tauri_utils::TitleBarStyle; use tauri_utils::{config::WindowConfig, debug_eprintln, Theme}; +use url::Url; use uuid::Uuid; use wry::{ application::{ @@ -211,6 +212,7 @@ impl Context { impl Context { fn create_webview(&self, pending: PendingWindow>) -> Result>> { let label = pending.label.clone(); + let current_url = pending.current_url.clone(); let menu_ids = pending.menu_ids.clone(); let js_event_listeners = pending.js_event_listeners.clone(); let context = self.clone(); @@ -232,6 +234,7 @@ impl Context { }; Ok(DetachedWindow { label, + current_url, dispatcher, menu_ids, js_event_listeners, @@ -1931,6 +1934,7 @@ impl Runtime for Wry { fn create_window(&self, pending: PendingWindow) -> Result> { let label = pending.label.clone(); + let current_url = pending.current_url.clone(); let menu_ids = pending.menu_ids.clone(); let js_event_listeners = pending.js_event_listeners.clone(); let window_id = rand::random(); @@ -1957,6 +1961,7 @@ impl Runtime for Wry { Ok(DetachedWindow { label, + current_url, dispatcher, menu_ids, js_event_listeners, @@ -2944,7 +2949,7 @@ fn create_webview( mut window_builder, ipc_handler, label, - url, + current_url, menu_ids, js_event_listeners, .. @@ -2990,7 +2995,7 @@ fn create_webview( } let mut webview_builder = WebViewBuilder::new(window) .map_err(|e| Error::CreateWebview(Box::new(e)))? - .with_url(&url) + .with_url(current_url.lock().unwrap().as_str()) .unwrap() // safe to unwrap because we validate the URL beforehand .with_transparent(is_window_transparent) .with_accept_first_mouse(webview_attributes.accept_first_mouse); @@ -3001,10 +3006,16 @@ fn create_webview( if let Some(user_agent) = webview_attributes.user_agent { webview_builder = webview_builder.with_user_agent(&user_agent); } + if let Some(navigation_handler) = pending.navigation_handler { + webview_builder = webview_builder.with_navigation_handler(move |url| { + Url::parse(&url).map(&navigation_handler).unwrap_or(true) + }); + } if let Some(handler) = ipc_handler { webview_builder = webview_builder.with_ipc_handler(create_ipc_handler( context, label.clone(), + current_url, menu_ids, js_event_listeners, handler, @@ -3115,6 +3126,7 @@ fn create_webview( fn create_ipc_handler( context: Context, label: String, + current_url: Arc>, menu_ids: Arc>>, js_event_listeners: Arc>>>, handler: WebviewIpcHandler>, @@ -3123,6 +3135,7 @@ fn create_ipc_handler( let window_id = context.webview_id_map.get(&window.id()).unwrap(); handler( DetachedWindow { + current_url: current_url.clone(), dispatcher: WryDispatcher { window_id, context: context.clone(), diff --git a/core/tauri-runtime/Cargo.toml b/core/tauri-runtime/Cargo.toml index b8a090f9093..949813a891d 100644 --- a/core/tauri-runtime/Cargo.toml +++ b/core/tauri-runtime/Cargo.toml @@ -32,6 +32,7 @@ http = "0.2.4" http-range = "0.1.4" raw-window-handle = "0.5" rand = "0.8" +url = "2" [target."cfg(windows)".dependencies] webview2-com = "0.19.1" diff --git a/core/tauri-runtime/src/window.rs b/core/tauri-runtime/src/window.rs index c07408b5479..857ae4c367a 100644 --- a/core/tauri-runtime/src/window.rs +++ b/core/tauri-runtime/src/window.rs @@ -12,6 +12,7 @@ use crate::{ }; use serde::{Deserialize, Deserializer, Serialize}; use tauri_utils::{config::WindowConfig, Theme}; +use url::Url; use std::{ collections::{HashMap, HashSet}, @@ -224,14 +225,17 @@ pub struct PendingWindow> { /// How to handle IPC calls on the webview window. pub ipc_handler: Option>, - /// The resolved URL to load on the webview. - pub url: String, - /// Maps runtime id to a string menu id. pub menu_ids: Arc>>, /// A HashMap mapping JS event names with associated listener ids. pub js_event_listeners: Arc>>>, + + /// A handler to decide if incoming url is allowed to navigate. + pub navigation_handler: Option bool + Send>>, + + /// The current webview URL. + pub current_url: Arc>, } pub fn is_label_valid(label: &str) -> bool { @@ -268,9 +272,10 @@ impl> PendingWindow { uri_scheme_protocols: Default::default(), label, ipc_handler: None, - url: "tauri://localhost".to_string(), menu_ids: Arc::new(Mutex::new(menu_ids)), js_event_listeners: Default::default(), + navigation_handler: Default::default(), + current_url: Arc::new(Mutex::new("tauri://localhost".parse().unwrap())), }) } } @@ -297,9 +302,10 @@ impl> PendingWindow { uri_scheme_protocols: Default::default(), label, ipc_handler: None, - url: "tauri://localhost".to_string(), menu_ids: Arc::new(Mutex::new(menu_ids)), js_event_listeners: Default::default(), + navigation_handler: Default::default(), + current_url: Arc::new(Mutex::new("tauri://localhost".parse().unwrap())), }) } } @@ -340,6 +346,9 @@ pub struct JsEventListenerKey { /// A webview window that is not yet managed by Tauri. #[derive(Debug)] pub struct DetachedWindow> { + /// The current webview URL. + pub current_url: Arc>, + /// Name of the window pub label: String, @@ -356,6 +365,7 @@ pub struct DetachedWindow> { impl> Clone for DetachedWindow { fn clone(&self) -> Self { Self { + current_url: self.current_url.clone(), label: self.label.clone(), dispatcher: self.dispatcher.clone(), menu_ids: self.menu_ids.clone(), diff --git a/core/tauri/src/app.rs b/core/tauri/src/app.rs index 14eb6b07101..8689cf63e73 100644 --- a/core/tauri/src/app.rs +++ b/core/tauri/src/app.rs @@ -1017,7 +1017,7 @@ impl Builder { #[cfg(any(windows, target_os = "linux"))] runtime_any_thread: false, setup: Box::new(|_| Ok(())), - invoke_handler: Box::new(|_| ()), + invoke_handler: Box::new(|invoke| invoke.resolver.reject("not implemented")), invoke_responder: Arc::new(window_invoke_responder), invoke_initialization_script: "Object.defineProperty(window, '__TAURI_POST_MESSAGE__', { value: (message) => window.ipc.postMessage(JSON.stringify(message)) })".into(), diff --git a/core/tauri/src/manager.rs b/core/tauri/src/manager.rs index cdb100e8a15..6710a293647 100644 --- a/core/tauri/src/manager.rs +++ b/core/tauri/src/manager.rs @@ -25,10 +25,9 @@ use tauri_utils::{ html::{SCRIPT_NONCE_TOKEN, STYLE_NONCE_TOKEN}, }; -use crate::hooks::IpcJavascript; #[cfg(feature = "isolation")] use crate::hooks::IsolationJavascript; -use crate::pattern::{format_real_schema, PatternJavascript}; +use crate::pattern::PatternJavascript; use crate::{ app::{AppHandle, GlobalWindowEvent, GlobalWindowEventListener}, event::{assert_event_name_is_valid, Event, EventHandler, Listeners}, @@ -54,6 +53,7 @@ use crate::{ app::{GlobalMenuEventListener, WindowMenuEvent}, window::WebResourceRequestHandler, }; +use crate::{hooks::IpcJavascript, pattern::format_real_schema}; #[cfg(any(target_os = "linux", target_os = "windows"))] use crate::api::path::{resolve_path, BaseDirectory}; @@ -139,7 +139,7 @@ fn set_csp( let default_src = csp .entry("default-src".into()) .or_insert_with(Default::default); - default_src.push(format_real_schema(schema)); + default_src.push(crate::pattern::format_real_schema(schema)); } Csp::DirectiveMap(csp).to_string() @@ -231,7 +231,7 @@ pub struct InnerWindowManager { /// The script that initializes the invoke system. invoke_initialization_script: String, /// Application pattern. - pattern: Pattern, + pub(crate) pattern: Pattern, } impl fmt::Debug for InnerWindowManager { @@ -367,9 +367,12 @@ impl WindowManager { /// Get the base URL to use for webview requests. /// /// In dev mode, this will be based on the `devPath` configuration value. - fn get_url(&self) -> Cow<'_, Url> { + pub(crate) fn get_url(&self) -> Cow<'_, Url> { match self.base_path() { AppUrl::Url(WindowUrl::External(url)) => Cow::Borrowed(url), + #[cfg(windows)] + _ => Cow::Owned(Url::parse("https://tauri.localhost").unwrap()), + #[cfg(not(windows))] _ => Cow::Owned(Url::parse("tauri://localhost").unwrap()), } } @@ -477,7 +480,7 @@ impl WindowManager { }); } - let window_url = Url::parse(&pending.url).unwrap(); + let window_url = pending.current_url.lock().unwrap().clone(); let window_origin = if cfg!(windows) && window_url.scheme() != "http" && window_url.scheme() != "https" { format!("https://{}.localhost", window_url.scheme()) @@ -1072,7 +1075,16 @@ mod test { ); #[cfg(custom_protocol)] - assert_eq!(manager.get_url().to_string(), "tauri://localhost"); + { + assert_eq!( + manager.get_url().to_string(), + if cfg!(windows) { + "https://tauri.localhost/" + } else { + "tauri://localhost" + } + ); + } #[cfg(dev)] assert_eq!(manager.get_url().to_string(), "http://localhost:4000/"); @@ -1123,27 +1135,21 @@ impl WindowManager { return Err(crate::Error::WindowLabelAlreadyExists(pending.label)); } #[allow(unused_mut)] // mut url only for the data-url parsing - let (is_local, mut url) = match &pending.webview_attributes.url { + let mut url = match &pending.webview_attributes.url { WindowUrl::App(path) => { let url = self.get_url(); - ( - true, - // ignore "index.html" just to simplify the url - if path.to_str() != Some("index.html") { - url - .join(&path.to_string_lossy()) - .map_err(crate::Error::InvalidUrl) - // this will never fail - .unwrap() - } else { - url.into_owned() - }, - ) - } - WindowUrl::External(url) => { - let config_url = self.get_url(); - (config_url.make_relative(url).is_some(), url.clone()) + // ignore "index.html" just to simplify the url + if path.to_str() != Some("index.html") { + url + .join(&*path.to_string_lossy()) + .map_err(crate::Error::InvalidUrl) + // this will never fail + .unwrap() + } else { + url.into_owned() + } } + WindowUrl::External(url) => url.clone(), _ => unimplemented!(), }; @@ -1170,7 +1176,7 @@ impl WindowManager { } } - pending.url = url.to_string(); + *pending.current_url.lock().unwrap() = url; if !pending.window_builder.has_icon() { if let Some(default_window_icon) = self.inner.default_window_icon.clone() { @@ -1186,17 +1192,15 @@ impl WindowManager { } } - if is_local { - let label = pending.label.clone(); - pending = self.prepare_pending_window( - pending, - &label, - window_labels, - app_handle.clone(), - web_resource_request_handler, - )?; - pending.ipc_handler = Some(self.prepare_ipc_handler(app_handle)); - } + let label = pending.label.clone(); + pending = self.prepare_pending_window( + pending, + &label, + window_labels, + app_handle.clone(), + web_resource_request_handler, + )?; + pending.ipc_handler = Some(self.prepare_ipc_handler(app_handle)); // in `Windows`, we need to force a data_directory // but we do respect user-specification @@ -1221,6 +1225,17 @@ impl WindowManager { } } + let current_url_ = pending.current_url.clone(); + let navigation_handler = pending.navigation_handler.take(); + pending.navigation_handler = Some(Box::new(move |url| { + *current_url_.lock().unwrap() = url.clone(); + if let Some(handler) = &navigation_handler { + handler(url) + } else { + true + } + })); + Ok(pending) } diff --git a/core/tauri/src/pattern.rs b/core/tauri/src/pattern.rs index 660959dbbd6..ad802ba4543 100644 --- a/core/tauri/src/pattern.rs +++ b/core/tauri/src/pattern.rs @@ -11,6 +11,9 @@ use serialize_to_javascript::{default_template, Template}; use tauri_utils::assets::{Assets, EmbeddedAssets}; +/// The domain of the isolation iframe source. +pub const ISOLATION_IFRAME_SRC_DOMAIN: &str = "localhost"; + /// An application pattern. #[derive(Debug, Clone)] pub enum Pattern { @@ -87,8 +90,8 @@ pub(crate) struct PatternJavascript { #[allow(dead_code)] pub(crate) fn format_real_schema(schema: &str) -> String { if cfg!(windows) { - format!("https://{}.localhost", schema) + format!("https://{schema}.{ISOLATION_IFRAME_SRC_DOMAIN}") } else { - format!("{}://localhost", schema) + format!("{schema}://{ISOLATION_IFRAME_SRC_DOMAIN}") } } diff --git a/core/tauri/src/test/mock_runtime.rs b/core/tauri/src/test/mock_runtime.rs index 166766a6fc1..0f074c3acee 100644 --- a/core/tauri/src/test/mock_runtime.rs +++ b/core/tauri/src/test/mock_runtime.rs @@ -69,6 +69,7 @@ impl RuntimeHandle for MockRuntimeHandle { ) -> Result> { Ok(DetachedWindow { label: pending.label, + current_url: Arc::new(Mutex::new("tauri://localhost".parse().unwrap())), dispatcher: MockDispatcher { context: self.context.clone(), }, @@ -665,6 +666,7 @@ impl Runtime for MockRuntime { fn create_window(&self, pending: PendingWindow) -> Result> { Ok(DetachedWindow { label: pending.label, + current_url: Arc::new(Mutex::new("tauri://localhost".parse().unwrap())), dispatcher: MockDispatcher { context: self.context.clone(), }, diff --git a/core/tauri/src/window.rs b/core/tauri/src/window.rs index 497c4fd17da..fb1752eefdb 100644 --- a/core/tauri/src/window.rs +++ b/core/tauri/src/window.rs @@ -35,6 +35,7 @@ use crate::{ }; use serde::Serialize; +use url::Url; #[cfg(windows)] use windows::Win32::Foundation::HWND; @@ -570,7 +571,7 @@ impl<'a, R: Runtime> WindowBuilder<'a, R> { #[derive(Debug)] pub struct Window { /// The webview window created by the runtime. - window: DetachedWindow, + pub(crate) window: DetachedWindow, /// The manager to associate this webview window with. manager: WindowManager, pub(crate) app_handle: AppHandle, @@ -1256,9 +1257,27 @@ impl Window { /// Webview APIs. impl Window { + /// Returns the current url of the webview. + pub fn url(&self) -> Url { + self.window.current_url.lock().unwrap().clone() + } + /// Handles this window receiving an [`InvokeMessage`]. pub fn on_message(self, payload: InvokePayload) -> crate::Result<()> { let manager = self.manager.clone(); + let current_url = self.url(); + let config_url = manager.get_url(); + #[allow(unused_mut)] + let mut is_local = config_url.make_relative(¤t_url).is_some(); + #[cfg(feature = "isolation")] + if let crate::Pattern::Isolation { schema, .. } = &self.manager.inner.pattern { + if current_url.scheme() == schema + && current_url.domain() == Some(crate::pattern::ISOLATION_IFRAME_SRC_DOMAIN) + { + is_local = true; + } + } + match payload.cmd.as_str() { "__initialized" => { let payload: PageLoadPayload = serde_json::from_value(payload.inner)?; @@ -1272,8 +1291,17 @@ impl Window { payload.inner, ); let resolver = InvokeResolver::new(self, payload.callback, payload.error); - let invoke = Invoke { message, resolver }; + + println!("{} {}", config_url, current_url); + + if !is_local { + invoke + .resolver + .reject("Remote URLs are not allowed to access the IPC"); + return Ok(()); + } + if let Some(module) = &payload.tauri_module { crate::endpoints::handle( module.to_string(), diff --git a/examples/api/src-tauri/Cargo.lock b/examples/api/src-tauri/Cargo.lock index 9feee8d01de..03cb6dad8f5 100644 --- a/examples/api/src-tauri/Cargo.lock +++ b/examples/api/src-tauri/Cargo.lock @@ -3128,7 +3128,7 @@ dependencies = [ [[package]] name = "tauri" -version = "1.2.0" +version = "1.1.3" dependencies = [ "anyhow", "attohttpc", @@ -3190,7 +3190,7 @@ dependencies = [ [[package]] name = "tauri-build" -version = "1.2.0" +version = "1.1.1" dependencies = [ "anyhow", "cargo_toml", @@ -3206,7 +3206,7 @@ dependencies = [ [[package]] name = "tauri-codegen" -version = "1.2.0" +version = "1.1.1" dependencies = [ "base64", "brotli", @@ -3230,7 +3230,7 @@ dependencies = [ [[package]] name = "tauri-macros" -version = "1.2.0" +version = "1.1.1" dependencies = [ "heck 0.4.0", "proc-macro2", @@ -3242,7 +3242,7 @@ dependencies = [ [[package]] name = "tauri-runtime" -version = "0.12.0" +version = "0.11.1" dependencies = [ "gtk", "http", @@ -3253,14 +3253,15 @@ dependencies = [ "serde_json", "tauri-utils", "thiserror", - "uuid 1.2.1", + "url", + "uuid 1.1.2", "webview2-com", "windows 0.39.0", ] [[package]] name = "tauri-runtime-wry" -version = "0.12.0" +version = "0.11.1" dependencies = [ "cocoa", "gtk", @@ -3269,7 +3270,8 @@ dependencies = [ "raw-window-handle", "tauri-runtime", "tauri-utils", - "uuid 1.2.1", + "url", + "uuid 1.1.2", "webkit2gtk", "webview2-com", "windows 0.39.0", @@ -3278,7 +3280,7 @@ dependencies = [ [[package]] name = "tauri-utils" -version = "1.2.0" +version = "1.1.1" dependencies = [ "aes-gcm", "brotli", From 2227abb34b9808eec2937c4ef1b268ad794f18b1 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Tue, 2 May 2023 10:01:57 -0300 Subject: [PATCH 5/7] fix(core): IPC remote domain check bypassed by isolation iframe usage (#6691) --- core/tauri/src/manager.rs | 11 +++++++++++ core/tauri/src/pattern.rs | 22 +++++++++++++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/core/tauri/src/manager.rs b/core/tauri/src/manager.rs index 6710a293647..83d3725fa5a 100644 --- a/core/tauri/src/manager.rs +++ b/core/tauri/src/manager.rs @@ -1225,9 +1225,20 @@ impl WindowManager { } } + #[cfg(feature = "isolation")] + let pattern = self.pattern().clone(); let current_url_ = pending.current_url.clone(); let navigation_handler = pending.navigation_handler.take(); pending.navigation_handler = Some(Box::new(move |url| { + // always allow navigation events for the isolation iframe and do not emit them for consumers + #[cfg(feature = "isolation")] + if let Pattern::Isolation { schema, .. } = &pattern { + if url.scheme() == schema + && url.domain() == Some(crate::pattern::ISOLATION_IFRAME_SRC_DOMAIN) + { + return true; + } + } *current_url_.lock().unwrap() = url.clone(); if let Some(handler) = &navigation_handler { handler(url) diff --git a/core/tauri/src/pattern.rs b/core/tauri/src/pattern.rs index ad802ba4543..335417fdece 100644 --- a/core/tauri/src/pattern.rs +++ b/core/tauri/src/pattern.rs @@ -15,7 +15,7 @@ use tauri_utils::assets::{Assets, EmbeddedAssets}; pub const ISOLATION_IFRAME_SRC_DOMAIN: &str = "localhost"; /// An application pattern. -#[derive(Debug, Clone)] +#[derive(Debug)] pub enum Pattern { /// The brownfield pattern. Brownfield(PhantomData), @@ -38,6 +38,26 @@ pub enum Pattern { }, } +impl Clone for Pattern { + fn clone(&self) -> Self { + match self { + Self::Brownfield(a) => Self::Brownfield(*a), + #[cfg(feature = "isolation")] + Self::Isolation { + assets, + schema, + key, + crypto_keys, + } => Self::Isolation { + assets: assets.clone(), + schema: schema.clone(), + key: key.clone(), + crypto_keys: crypto_keys.clone(), + }, + } + } +} + /// The shape of the JavaScript Pattern config #[derive(Debug, Serialize)] #[serde(rename_all = "lowercase", tag = "pattern")] From 961cec9c472978fa7a6e68f256f310bf3a74e1c4 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Tue, 2 May 2023 10:03:48 -0300 Subject: [PATCH 6/7] chore: remove println --- core/tauri/src/window.rs | 2 -- 1 file changed, 2 deletions(-) diff --git a/core/tauri/src/window.rs b/core/tauri/src/window.rs index fb1752eefdb..06dcda12598 100644 --- a/core/tauri/src/window.rs +++ b/core/tauri/src/window.rs @@ -1293,8 +1293,6 @@ impl Window { let resolver = InvokeResolver::new(self, payload.callback, payload.error); let invoke = Invoke { message, resolver }; - println!("{} {}", config_url, current_url); - if !is_local { invoke .resolver From 53a34a83bce765558da4723270124f7b6f8695c1 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 3 May 2023 12:23:50 -0300 Subject: [PATCH 7/7] chore: trigger release --- .changes/remote-urls.md | 7 ------- core/tauri-runtime-wry/CHANGELOG.md | 5 +++++ core/tauri-runtime-wry/Cargo.toml | 4 ++-- core/tauri-runtime/CHANGELOG.md | 5 +++++ core/tauri-runtime/Cargo.toml | 2 +- core/tauri/CHANGELOG.md | 5 +++++ core/tauri/Cargo.toml | 6 +++--- tooling/cli/metadata.json | 2 +- 8 files changed, 22 insertions(+), 14 deletions(-) delete mode 100644 .changes/remote-urls.md diff --git a/.changes/remote-urls.md b/.changes/remote-urls.md deleted file mode 100644 index 71d094cd97a..00000000000 --- a/.changes/remote-urls.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"tauri": patch -"tauri-runtime": patch -"tauri-runtime-wry": patch ---- - -Block remote URLs from accessing the IPC. diff --git a/core/tauri-runtime-wry/CHANGELOG.md b/core/tauri-runtime-wry/CHANGELOG.md index b67b9b265ec..fe7b5723e9c 100644 --- a/core/tauri-runtime-wry/CHANGELOG.md +++ b/core/tauri-runtime-wry/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## \[0.12.3] + +- Block remote URLs from accessing the IPC. + - [9c0593c33](https://www.github.com/tauri-apps/tauri/commit/9c0593c33af52cd9e00ec784d15f63efebdf039c) feat(core): block remote URLs from accessing the IPC on 2023-04-12 + ## \[0.12.2] - Fix compatibility with older Linux distributions. diff --git a/core/tauri-runtime-wry/Cargo.toml b/core/tauri-runtime-wry/Cargo.toml index 298ed3eef9e..57cc41c0c01 100644 --- a/core/tauri-runtime-wry/Cargo.toml +++ b/core/tauri-runtime-wry/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-runtime-wry" -version = "0.12.2" +version = "0.12.3" authors = [ "Tauri Programme within The Commons Conservancy" ] categories = [ "gui", "web-programming" ] license = "Apache-2.0 OR MIT" @@ -14,7 +14,7 @@ readme = "README.md" [dependencies] wry = { version = "0.23", default-features = false, features = [ "file-drop", "protocol" ] } -tauri-runtime = { version = "0.12.1", path = "../tauri-runtime" } +tauri-runtime = { version = "0.12.2", path = "../tauri-runtime" } tauri-utils = { version = "1.2.1", path = "../tauri-utils" } uuid = { version = "1", features = [ "v4" ] } rand = "0.8" diff --git a/core/tauri-runtime/CHANGELOG.md b/core/tauri-runtime/CHANGELOG.md index 084df72757b..88bb7f6eb62 100644 --- a/core/tauri-runtime/CHANGELOG.md +++ b/core/tauri-runtime/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## \[0.12.2] + +- Block remote URLs from accessing the IPC. + - [9c0593c33](https://www.github.com/tauri-apps/tauri/commit/9c0593c33af52cd9e00ec784d15f63efebdf039c) feat(core): block remote URLs from accessing the IPC on 2023-04-12 + ## \[0.12.1] - Fix `allowlist > app > show/hide` always disabled when `allowlist > app > all: false`. diff --git a/core/tauri-runtime/Cargo.toml b/core/tauri-runtime/Cargo.toml index 949813a891d..6c170d50bb7 100644 --- a/core/tauri-runtime/Cargo.toml +++ b/core/tauri-runtime/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-runtime" -version = "0.12.1" +version = "0.12.2" authors = [ "Tauri Programme within The Commons Conservancy" ] categories = [ "gui", "web-programming" ] license = "Apache-2.0 OR MIT" diff --git a/core/tauri/CHANGELOG.md b/core/tauri/CHANGELOG.md index 208b96bccbb..17b48555ac7 100644 --- a/core/tauri/CHANGELOG.md +++ b/core/tauri/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## \[1.2.5] + +- Block remote URLs from accessing the IPC. + - [9c0593c33](https://www.github.com/tauri-apps/tauri/commit/9c0593c33af52cd9e00ec784d15f63efebdf039c) feat(core): block remote URLs from accessing the IPC on 2023-04-12 + ## \[1.2.4] - Pin `ignore` to `=0.4.18`. diff --git a/core/tauri/Cargo.toml b/core/tauri/Cargo.toml index f82c9d45a04..d64bab7621b 100644 --- a/core/tauri/Cargo.toml +++ b/core/tauri/Cargo.toml @@ -10,7 +10,7 @@ license = "Apache-2.0 OR MIT" name = "tauri" readme = "README.md" repository = "https://github.com/tauri-apps/tauri" -version = "1.2.4" +version = "1.2.5" [package.metadata.docs.rs] no-default-features = true @@ -49,10 +49,10 @@ url = { version = "2.3" } anyhow = "1.0" thiserror = "1.0" once_cell = "1" -tauri-runtime = { version = "0.12.1", path = "../tauri-runtime" } +tauri-runtime = { version = "0.12.2", path = "../tauri-runtime" } tauri-macros = { version = "1.2.1", path = "../tauri-macros" } tauri-utils = { version = "1.2.1", features = [ "resources" ], path = "../tauri-utils" } -tauri-runtime-wry = { version = "0.12.2", path = "../tauri-runtime-wry", optional = true } +tauri-runtime-wry = { version = "0.12.3", path = "../tauri-runtime-wry", optional = true } rand = "0.8" semver = { version = "1.0", features = [ "serde" ] } serde_repr = "0.1" diff --git a/tooling/cli/metadata.json b/tooling/cli/metadata.json index 50acced3453..aaa65110a77 100644 --- a/tooling/cli/metadata.json +++ b/tooling/cli/metadata.json @@ -3,6 +3,6 @@ "version": "1.2.3", "node": ">= 10.0.0" }, - "tauri": "1.2.4", + "tauri": "1.2.5", "tauri-build": "1.2.1" }