From 685610ae782b668770d412f42a5d52d2cc9e497e Mon Sep 17 00:00:00 2001 From: Tony <68118705+Legend-Master@users.noreply.github.com> Date: Mon, 10 Aug 2026 15:48:27 +0800 Subject: [PATCH] fix(fs): default permissions (#3507) * Fix deny-webview-data platfroms and scopes * Fix `create-app-specific-dirs` scopes * Fix read-app-specific-dirs-recursive * Re-generate schema and docs * Remove unused `fs:allow-unwatch` * Add change file * Remove unused permissions * Update linux permissions * Update change file * regenerate doc md and schema --- .changes/fix-fs-scopes.md | 6 +++ .changes/fs-deny-scope.md | 2 +- examples/api/src-tauri/capabilities/base.json | 7 +--- .../api/src-tauri/capabilities/desktop.json | 3 +- .../fs/permissions/autogenerated/reference.md | 23 +++++++++--- .../permissions/create-app-specific-dirs.toml | 4 +- plugins/fs/permissions/default.toml | 4 +- plugins/fs/permissions/deny-webview-data.toml | 37 +++++++++++++++++-- .../read-app-specific-dirs-recursive.toml | 18 ++++----- plugins/fs/permissions/schemas/schema.json | 20 +++++----- 10 files changed, 85 insertions(+), 39 deletions(-) create mode 100644 .changes/fix-fs-scopes.md diff --git a/.changes/fix-fs-scopes.md b/.changes/fix-fs-scopes.md new file mode 100644 index 000000000..a1ea49674 --- /dev/null +++ b/.changes/fix-fs-scopes.md @@ -0,0 +1,6 @@ +--- +"fs": patch +"fs-js": patch +--- + +Fix `fs:default` and `fs:read-app-specific-dirs-recursive` not giving any command scopes diff --git a/.changes/fs-deny-scope.md b/.changes/fs-deny-scope.md index ca8974699..cc1cca600 100644 --- a/.changes/fs-deny-scope.md +++ b/.changes/fs-deny-scope.md @@ -3,4 +3,4 @@ "fs-js": patch --- -Fixed `deny-webview-data` has no effect \ No newline at end of file +Fixed `deny-webview-data` has no effect, and on Linux, only deny access to the webview data paths instead of the entire `$APPLOCALDATA` \ No newline at end of file diff --git a/examples/api/src-tauri/capabilities/base.json b/examples/api/src-tauri/capabilities/base.json index 91b2d6b45..637bfa496 100644 --- a/examples/api/src-tauri/capabilities/base.json +++ b/examples/api/src-tauri/capabilities/base.json @@ -16,7 +16,6 @@ }, "core:default", "core:app:allow-set-app-theme", - "fs:default", "core:window:allow-minimize", "core:window:allow-toggle-maximize", "core:window:allow-close", @@ -58,17 +57,15 @@ "clipboard-manager:allow-write-text", "clipboard-manager:allow-read-image", "clipboard-manager:allow-write-image", + "fs:default", + "fs:read-meta", "fs:allow-open", "fs:allow-write", "fs:allow-read", "fs:allow-rename", "fs:allow-mkdir", "fs:allow-remove", - "fs:allow-stat", - "fs:allow-fstat", - "fs:allow-lstat", "fs:allow-write-text-file", - "fs:read-meta", "fs:scope-download-recursive", "fs:scope-resource-recursive", { diff --git a/examples/api/src-tauri/capabilities/desktop.json b/examples/api/src-tauri/capabilities/desktop.json index 82d8354f5..2c6fcf8ad 100644 --- a/examples/api/src-tauri/capabilities/desktop.json +++ b/examples/api/src-tauri/capabilities/desktop.json @@ -10,7 +10,6 @@ "global-shortcut:allow-unregister", "global-shortcut:allow-register", "global-shortcut:allow-unregister-all", - { "identifier": "fs:allow-watch", "allow": ["*", "**/*"] }, - "fs:allow-unwatch" + { "identifier": "fs:allow-watch", "allow": ["*", "**/*"] } ] } diff --git a/plugins/fs/permissions/autogenerated/reference.md b/plugins/fs/permissions/autogenerated/reference.md index 8aa25d510..49589f094 100644 --- a/plugins/fs/permissions/autogenerated/reference.md +++ b/plugins/fs/permissions/autogenerated/reference.md @@ -22,7 +22,9 @@ the `mkdir` command. This default permission set prevents access to critical components of the Tauri application by default. -On Windows the webview data folder access is denied. + +- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied. +- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied. #### This default permission set includes the following: @@ -3701,8 +3703,19 @@ This denies access to dangerous Tauri relevant files and folders by default. -This denies read access to the -`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here. +This denies access to the following paths + +- `$APPLOCALDATA/CacheStorage/**` +- `$APPLOCALDATA/cookies` +- `$APPLOCALDATA/hsts-storage.sqlite` +- `$APPLOCALDATA/serviceworkers/**` +- `$APPLOCALDATA/WebKitCache/**` +- `$APPLOCALDATA/databases/**` +- `$APPLOCALDATA/localstorage/**` +- `$APPLOCALDATA/mediakeys/**` +- `$APPLOCALDATA/storage/**` + +on linux as the webview data and configuration values are stored here. Allowing access can lead to sensitive information disclosure and should be well considered. @@ -3716,7 +3729,7 @@ Allowing access can lead to sensitive information disclosure and should be well -This denies read access to the +This denies access to the `$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here. Allowing access can lead to sensitive information disclosure and should be well considered. @@ -3745,7 +3758,7 @@ This enables all read related commands without any pre-configured accessible pat This permission allows recursive read functionality on the application -specific base directories. +specific base directories. diff --git a/plugins/fs/permissions/create-app-specific-dirs.toml b/plugins/fs/permissions/create-app-specific-dirs.toml index 7785cb13c..3c722937b 100644 --- a/plugins/fs/permissions/create-app-specific-dirs.toml +++ b/plugins/fs/permissions/create-app-specific-dirs.toml @@ -1,8 +1,8 @@ "$schema" = "schemas/schema.json" -[[permission]] +[[set]] identifier = "create-app-specific-dirs" description = """ This permissions allows to create the application specific directories. """ -commands.allow = ["mkdir", "scope-app-index"] +permissions = ["allow-mkdir", "scope-app-index"] diff --git a/plugins/fs/permissions/default.toml b/plugins/fs/permissions/default.toml index 78836df71..2afcc7d0e 100644 --- a/plugins/fs/permissions/default.toml +++ b/plugins/fs/permissions/default.toml @@ -24,7 +24,9 @@ the `mkdir` command. This default permission set prevents access to critical components of the Tauri application by default. -On Windows the webview data folder access is denied. + +- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied. +- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied. """ permissions = [ "create-app-specific-dirs", diff --git a/plugins/fs/permissions/deny-webview-data.toml b/plugins/fs/permissions/deny-webview-data.toml index 3636ac6d4..eec5991c1 100644 --- a/plugins/fs/permissions/deny-webview-data.toml +++ b/plugins/fs/permissions/deny-webview-data.toml @@ -2,18 +2,47 @@ [[permission]] identifier = "deny-webview-data-linux" -description = """This denies read access to the -`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here. +description = """This denies access to the following paths + +- `$APPLOCALDATA/CacheStorage/**` +- `$APPLOCALDATA/cookies` +- `$APPLOCALDATA/hsts-storage.sqlite` +- `$APPLOCALDATA/serviceworkers/**` +- `$APPLOCALDATA/WebKitCache/**` +- `$APPLOCALDATA/databases/**` +- `$APPLOCALDATA/localstorage/**` +- `$APPLOCALDATA/mediakeys/**` +- `$APPLOCALDATA/storage/**` + +on linux as the webview data and configuration values are stored here. Allowing access can lead to sensitive information disclosure and should be well considered.""" +platforms = ["linux"] [[permission.scope.deny]] -path = "$APPLOCALDATA/**" +path = "$APPLOCALDATA/CacheStorage/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/cookies" +[[permission.scope.deny]] +path = "$APPLOCALDATA/hsts-storage.sqlite" +[[permission.scope.deny]] +path = "$APPLOCALDATA/serviceworkers/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/WebKitCache/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/databases/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/localstorage/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/mediakeys/**" +[[permission.scope.deny]] +path = "$APPLOCALDATA/storage/**" [[permission]] identifier = "deny-webview-data-windows" -description = """This denies read access to the +description = """This denies access to the `$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here. Allowing access can lead to sensitive information disclosure and should be well considered.""" +platforms = ["windows"] [[permission.scope.deny]] path = "$APPLOCALDATA/EBWebView/**" diff --git a/plugins/fs/permissions/read-app-specific-dirs-recursive.toml b/plugins/fs/permissions/read-app-specific-dirs-recursive.toml index 5342dbc0b..8da8c1d4a 100644 --- a/plugins/fs/permissions/read-app-specific-dirs-recursive.toml +++ b/plugins/fs/permissions/read-app-specific-dirs-recursive.toml @@ -1,17 +1,17 @@ "$schema" = "schemas/schema.json" -[[permission]] +[[set]] identifier = "read-app-specific-dirs-recursive" description = """ This permission allows recursive read functionality on the application -specific base directories. +specific base directories. """ -commands.allow = [ - "read_dir", - "read_file", - "read_text_file", - "read_text_file_lines", - "read_text_file_lines_next", - "exists", +permissions = [ + "allow-read-dir", + "allow-read-file", + "allow-read-text-file", + "allow-read-text-file-lines", + "allow-read-text-file-lines-next", + "allow-exists", "scope-app-recursive", ] diff --git a/plugins/fs/permissions/schemas/schema.json b/plugins/fs/permissions/schemas/schema.json index 39db5e9c8..c274b7c99 100644 --- a/plugins/fs/permissions/schemas/schema.json +++ b/plugins/fs/permissions/schemas/schema.json @@ -1969,16 +1969,16 @@ "markdownDescription": "Denies the write_text_file command without any pre-configured scope." }, { - "description": "This permissions allows to create the application specific directories.\n", + "description": "This permissions allows to create the application specific directories.\n\n#### This permission set includes:\n\n- `allow-mkdir`\n- `scope-app-index`", "type": "string", "const": "create-app-specific-dirs", - "markdownDescription": "This permissions allows to create the application specific directories.\n" + "markdownDescription": "This permissions allows to create the application specific directories.\n\n#### This permission set includes:\n\n- `allow-mkdir`\n- `scope-app-index`" }, { - "description": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\nOn Windows the webview data folder access is denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`", + "description": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\n\n- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.\n- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`", "type": "string", "const": "default", - "markdownDescription": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\nOn Windows the webview data folder access is denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`" + "markdownDescription": "This set of permissions describes the what kind of\nfile system access the `fs` plugin has enabled or denied by default.\n\n#### Granted Permissions\n\nThis default permission set enables read access to the\napplication specific directories (AppConfig, AppData, AppLocalData, AppCache,\nAppLog) and all files and sub directories created in it.\nThe location of these directories depends on the operating system,\nwhere the application is run.\n\nIn general these directories need to be manually created\nby the application at runtime, before accessing files or folders\nin it is possible.\n\nTherefore, it is also allowed to create all of these folders via\nthe `mkdir` command.\n\n#### Denied Permissions\n\nThis default permission set prevents access to critical components\nof the Tauri application by default.\n\n- On Windows the access to webview data folder `$APPLOCALDATA/EBWebView` is denied.\n- On Linux the access to webview data paths inside `$APPLOCALDATA` are denied.\n\n#### This default permission set includes:\n\n- `create-app-specific-dirs`\n- `read-app-specific-dirs-recursive`\n- `deny-default`" }, { "description": "This denies access to dangerous Tauri relevant files and folders by default.\n#### This permission set includes:\n\n- `deny-webview-data-linux`\n- `deny-webview-data-windows`", @@ -1987,16 +1987,16 @@ "markdownDescription": "This denies access to dangerous Tauri relevant files and folders by default.\n#### This permission set includes:\n\n- `deny-webview-data-linux`\n- `deny-webview-data-windows`" }, { - "description": "This denies read access to the\n`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.", + "description": "This denies access to the following paths\n\n- `$APPLOCALDATA/CacheStorage/**`\n- `$APPLOCALDATA/cookies`\n- `$APPLOCALDATA/hsts-storage.sqlite`\n- `$APPLOCALDATA/serviceworkers/**`\n- `$APPLOCALDATA/WebKitCache/**`\n- `$APPLOCALDATA/databases/**`\n- `$APPLOCALDATA/localstorage/**`\n- `$APPLOCALDATA/mediakeys/**`\n- `$APPLOCALDATA/storage/**`\n\non linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.", "type": "string", "const": "deny-webview-data-linux", - "markdownDescription": "This denies read access to the\n`$APPLOCALDATA` folder on linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered." + "markdownDescription": "This denies access to the following paths\n\n- `$APPLOCALDATA/CacheStorage/**`\n- `$APPLOCALDATA/cookies`\n- `$APPLOCALDATA/hsts-storage.sqlite`\n- `$APPLOCALDATA/serviceworkers/**`\n- `$APPLOCALDATA/WebKitCache/**`\n- `$APPLOCALDATA/databases/**`\n- `$APPLOCALDATA/localstorage/**`\n- `$APPLOCALDATA/mediakeys/**`\n- `$APPLOCALDATA/storage/**`\n\non linux as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered." }, { - "description": "This denies read access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.", + "description": "This denies access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered.", "type": "string", "const": "deny-webview-data-windows", - "markdownDescription": "This denies read access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered." + "markdownDescription": "This denies access to the\n`$APPLOCALDATA/EBWebView` folder on windows as the webview data and configuration values are stored here.\nAllowing access can lead to sensitive information disclosure and should be well considered." }, { "description": "This enables all read related commands without any pre-configured accessible paths.", @@ -2005,10 +2005,10 @@ "markdownDescription": "This enables all read related commands without any pre-configured accessible paths." }, { - "description": "This permission allows recursive read functionality on the application\nspecific base directories. \n", + "description": "This permission allows recursive read functionality on the application\nspecific base directories.\n\n#### This permission set includes:\n\n- `allow-read-dir`\n- `allow-read-file`\n- `allow-read-text-file`\n- `allow-read-text-file-lines`\n- `allow-read-text-file-lines-next`\n- `allow-exists`\n- `scope-app-recursive`", "type": "string", "const": "read-app-specific-dirs-recursive", - "markdownDescription": "This permission allows recursive read functionality on the application\nspecific base directories. \n" + "markdownDescription": "This permission allows recursive read functionality on the application\nspecific base directories.\n\n#### This permission set includes:\n\n- `allow-read-dir`\n- `allow-read-file`\n- `allow-read-text-file`\n- `allow-read-text-file-lines`\n- `allow-read-text-file-lines-next`\n- `allow-exists`\n- `scope-app-recursive`" }, { "description": "This enables directory read and file metadata related commands without any pre-configured accessible paths.",