mirror of
https://github.com/tauri-apps/plugins-workspace.git
synced 2026-08-11 18:40:22 +02:00
fix(fs): default permissions (#3507)
* Fix deny-webview-data platfroms and scopes * Fix `create-app-specific-dirs` scopes * Fix read-app-specific-dirs-recursive * Re-generate schema and docs * Remove unused `fs:allow-unwatch` * Add change file * Remove unused permissions * Update linux permissions * Update change file * regenerate doc md and schema
This commit is contained in:
Tony
@@ -0,0 +1,6 @@
|
||||
---
|
||||
"fs": patch
|
||||
"fs-js": patch
|
||||
---
|
||||
|
||||
Fix `fs:default` and `fs:read-app-specific-dirs-recursive` not giving any command scopes
|
||||
@@ -3,4 +3,4 @@
|
||||
"fs-js": patch
|
||||
---
|
||||
|
||||
Fixed `deny-webview-data` has no effect
|
||||
Fixed `deny-webview-data` has no effect, and on Linux, only deny access to the webview data paths instead of the entire `$APPLOCALDATA`
|
||||
@@ -16,7 +16,6 @@
|
||||
},
|
||||
"core:default",
|
||||
"core:app:allow-set-app-theme",
|
||||
"fs:default",
|
||||
"core:window:allow-minimize",
|
||||
"core:window:allow-toggle-maximize",
|
||||
"core:window:allow-close",
|
||||
@@ -58,17 +57,15 @@
|
||||
"clipboard-manager:allow-write-text",
|
||||
"clipboard-manager:allow-read-image",
|
||||
"clipboard-manager:allow-write-image",
|
||||
"fs:default",
|
||||
"fs:read-meta",
|
||||
"fs:allow-open",
|
||||
"fs:allow-write",
|
||||
"fs:allow-read",
|
||||
"fs:allow-rename",
|
||||
"fs:allow-mkdir",
|
||||
"fs:allow-remove",
|
||||
"fs:allow-stat",
|
||||
"fs:allow-fstat",
|
||||
"fs:allow-lstat",
|
||||
"fs:allow-write-text-file",
|
||||
"fs:read-meta",
|
||||
"fs:scope-download-recursive",
|
||||
"fs:scope-resource-recursive",
|
||||
{
|
||||
|
||||
@@ -10,7 +10,6 @@
|
||||
"global-shortcut:allow-unregister",
|
||||
"global-shortcut:allow-register",
|
||||
"global-shortcut:allow-unregister-all",
|
||||
{ "identifier": "fs:allow-watch", "allow": ["*", "**/*"] },
|
||||
"fs:allow-unwatch"
|
||||
{ "identifier": "fs:allow-watch", "allow": ["*", "**/*"] }
|
||||
]
|
||||
}
|
||||
|
||||
@@ -22,7 +22,9 @@ the `mkdir` command.
|
||||
|
||||
This default permission set prevents access to critical components
|
||||
of the Tauri application by default.
|
||||
On Windows the webview data folder access is denied.
|
||||
|
||||
- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.
|
||||
- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.
|
||||
|
||||
#### This default permission set includes the following:
|
||||
|
||||
@@ -3701,8 +3703,19 @@ This denies access to dangerous Tauri relevant files and folders by default.
|
||||
</td>
|
||||
<td>
|
||||
|
||||
This denies read access to the
|
||||
`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.
|
||||
This denies access to the following paths
|
||||
|
||||
- `$APPLOCALDATA/CacheStorage/**`
|
||||
- `$APPLOCALDATA/cookies`
|
||||
- `$APPLOCALDATA/hsts-storage.sqlite`
|
||||
- `$APPLOCALDATA/serviceworkers/**`
|
||||
- `$APPLOCALDATA/WebKitCache/**`
|
||||
- `$APPLOCALDATA/databases/**`
|
||||
- `$APPLOCALDATA/localstorage/**`
|
||||
- `$APPLOCALDATA/mediakeys/**`
|
||||
- `$APPLOCALDATA/storage/**`
|
||||
|
||||
on linux as the webview data and configuration values are stored here.
|
||||
Allowing access can lead to sensitive information disclosure and should be well considered.
|
||||
|
||||
</td>
|
||||
@@ -3716,7 +3729,7 @@ Allowing access can lead to sensitive information disclosure and should be well
|
||||
</td>
|
||||
<td>
|
||||
|
||||
This denies read access to the
|
||||
This denies access to the
|
||||
`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.
|
||||
Allowing access can lead to sensitive information disclosure and should be well considered.
|
||||
|
||||
@@ -3745,7 +3758,7 @@ This enables all read related commands without any pre-configured accessible pat
|
||||
<td>
|
||||
|
||||
This permission allows recursive read functionality on the application
|
||||
specific base directories.
|
||||
specific base directories.
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
"$schema" = "schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
[[set]]
|
||||
identifier = "create-app-specific-dirs"
|
||||
description = """
|
||||
This permissions allows to create the application specific directories.
|
||||
"""
|
||||
commands.allow = ["mkdir", "scope-app-index"]
|
||||
permissions = ["allow-mkdir", "scope-app-index"]
|
||||
|
||||
@@ -24,7 +24,9 @@ the `mkdir` command.
|
||||
|
||||
This default permission set prevents access to critical components
|
||||
of the Tauri application by default.
|
||||
On Windows the webview data folder access is denied.
|
||||
|
||||
- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.
|
||||
- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.
|
||||
"""
|
||||
permissions = [
|
||||
"create-app-specific-dirs",
|
||||
|
||||
@@ -2,18 +2,47 @@
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-webview-data-linux"
|
||||
description = """This denies read access to the
|
||||
`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.
|
||||
description = """This denies access to the following paths
|
||||
|
||||
- `$APPLOCALDATA/CacheStorage/**`
|
||||
- `$APPLOCALDATA/cookies`
|
||||
- `$APPLOCALDATA/hsts-storage.sqlite`
|
||||
- `$APPLOCALDATA/serviceworkers/**`
|
||||
- `$APPLOCALDATA/WebKitCache/**`
|
||||
- `$APPLOCALDATA/databases/**`
|
||||
- `$APPLOCALDATA/localstorage/**`
|
||||
- `$APPLOCALDATA/mediakeys/**`
|
||||
- `$APPLOCALDATA/storage/**`
|
||||
|
||||
on linux as the webview data and configuration values are stored here.
|
||||
Allowing access can lead to sensitive information disclosure and should be well considered."""
|
||||
platforms = ["linux"]
|
||||
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/**"
|
||||
path = "$APPLOCALDATA/CacheStorage/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/cookies"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/hsts-storage.sqlite"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/serviceworkers/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/WebKitCache/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/databases/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/localstorage/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/mediakeys/**"
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/storage/**"
|
||||
|
||||
[[permission]]
|
||||
identifier = "deny-webview-data-windows"
|
||||
description = """This denies read access to the
|
||||
description = """This denies access to the
|
||||
`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.
|
||||
Allowing access can lead to sensitive information disclosure and should be well considered."""
|
||||
platforms = ["windows"]
|
||||
|
||||
[[permission.scope.deny]]
|
||||
path = "$APPLOCALDATA/EBWebView/**"
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
"$schema" = "schemas/schema.json"
|
||||
|
||||
[[permission]]
|
||||
[[set]]
|
||||
identifier = "read-app-specific-dirs-recursive"
|
||||
description = """
|
||||
This permission allows recursive read functionality on the application
|
||||
specific base directories.
|
||||
specific base directories.
|
||||
"""
|
||||
commands.allow = [
|
||||
"read_dir",
|
||||
"read_file",
|
||||
"read_text_file",
|
||||
"read_text_file_lines",
|
||||
"read_text_file_lines_next",
|
||||
"exists",
|
||||
permissions = [
|
||||
"allow-read-dir",
|
||||
"allow-read-file",
|
||||
"allow-read-text-file",
|
||||
"allow-read-text-file-lines",
|
||||
"allow-read-text-file-lines-next",
|
||||
"allow-exists",
|
||||
"scope-app-recursive",
|
||||
]
|
||||
|
||||
@@ -1969,16 +1969,16 @@
|
||||
"markdownDescription": "Denies the write_text_file command without any pre-configured scope."
|
||||
},
|
||||
{
|
||||
"description": "This permissions allows to create the application specific directories.\n",
|
||||
"description": "This permissions allows to create the application specific directories.\n\n#### This permission set includes:\n\n- `allow-mkdir`\n- `scope-app-index`",
|
||||
"type": "string",
|
||||
"const": "create-app-specific-dirs",
|
||||
"markdownDescription": "This permissions allows to create the application specific directories.\n"
|
||||
"markdownDescription": "This permissions allows to create the application specific directories.\n\n#### This permission set includes:\n\n- `allow-mkdir`\n- `scope-app-index`"
|
||||
},
|
||||
{
|
||||
"description": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\nOn Windows the webview data folder access is denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`",
|
||||
"description": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\n\n- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.\n- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`",
|
||||
"type": "string",
|
||||
"const": "default",
|
||||
"markdownDescription": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\nOn Windows the webview data folder access is denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`"
|
||||
"markdownDescription": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\n\n- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.\n- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`"
|
||||
},
|
||||
{
|
||||
"description": "This denies access to dangerous Tauri relevant files and folders by default.\n#### This permission set includes:\n\n- `deny-webview-data-linux`\n- `deny-webview-data-windows`",
|
||||
@@ -1987,16 +1987,16 @@
|
||||
"markdownDescription": "This denies access to dangerous Tauri relevant files and folders by default.\n#### This permission set includes:\n\n- `deny-webview-data-linux`\n- `deny-webview-data-windows`"
|
||||
},
|
||||
{
|
||||
"description": "This denies read access to the\n`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.",
|
||||
"description": "This denies access to the following paths\n\n- `$APPLOCALDATA/CacheStorage/**`\n- `$APPLOCALDATA/cookies`\n- `$APPLOCALDATA/hsts-storage.sqlite`\n- `$APPLOCALDATA/serviceworkers/**`\n- `$APPLOCALDATA/WebKitCache/**`\n- `$APPLOCALDATA/databases/**`\n- `$APPLOCALDATA/localstorage/**`\n- `$APPLOCALDATA/mediakeys/**`\n- `$APPLOCALDATA/storage/**`\n\non linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.",
|
||||
"type": "string",
|
||||
"const": "deny-webview-data-linux",
|
||||
"markdownDescription": "This denies read access to the\n`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered."
|
||||
"markdownDescription": "This denies access to the following paths\n\n- `$APPLOCALDATA/CacheStorage/**`\n- `$APPLOCALDATA/cookies`\n- `$APPLOCALDATA/hsts-storage.sqlite`\n- `$APPLOCALDATA/serviceworkers/**`\n- `$APPLOCALDATA/WebKitCache/**`\n- `$APPLOCALDATA/databases/**`\n- `$APPLOCALDATA/localstorage/**`\n- `$APPLOCALDATA/mediakeys/**`\n- `$APPLOCALDATA/storage/**`\n\non linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered."
|
||||
},
|
||||
{
|
||||
"description": "This denies read access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.",
|
||||
"description": "This denies access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.",
|
||||
"type": "string",
|
||||
"const": "deny-webview-data-windows",
|
||||
"markdownDescription": "This denies read access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered."
|
||||
"markdownDescription": "This denies access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered."
|
||||
},
|
||||
{
|
||||
"description": "This enables all read related commands without any pre-configured accessible paths.",
|
||||
@@ -2005,10 +2005,10 @@
|
||||
"markdownDescription": "This enables all read related commands without any pre-configured accessible paths."
|
||||
},
|
||||
{
|
||||
"description": "This permission allows recursive read functionality on the application\nspecific base directories. \n",
|
||||
"description": "This permission allows recursive read functionality on the application\nspecific base directories.\n\n#### This permission set includes:\n\n- `allow-read-dir`\n- `allow-read-file`\n- `allow-read-text-file`\n- `allow-read-text-file-lines`\n- `allow-read-text-file-lines-next`\n- `allow-exists`\n- `scope-app-recursive`",
|
||||
"type": "string",
|
||||
"const": "read-app-specific-dirs-recursive",
|
||||
"markdownDescription": "This permission allows recursive read functionality on the application\nspecific base directories. \n"
|
||||
"markdownDescription": "This permission allows recursive read functionality on the application\nspecific base directories.\n\n#### This permission set includes:\n\n- `allow-read-dir`\n- `allow-read-file`\n- `allow-read-text-file`\n- `allow-read-text-file-lines`\n- `allow-read-text-file-lines-next`\n- `allow-exists`\n- `scope-app-recursive`"
|
||||
},
|
||||
{
|
||||
"description": "This enables directory read and file metadata related commands without any pre-configured accessible paths.",
|
||||
|
||||
Reference in New Issue
Block a user