CalvinBackup/tauri-plugins-workspace
1
0
Fork 0
mirror of https://github.com/tauri-apps/plugins-workspace.git synced 2026-07-24 17:20:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix(shell): properly validate open scope

* change empty regex to an impossible match

---------

Co-authored-by: Lucas Nogueira <lucas@tauri.app>
Co-authored-by: Chip Reed <chip@chip.sh>
This commit is contained in:
Tillmann
2025-04-02 12:24:25 +09:00
committed by GitHub
parent 4dd5c51436
commit 9cf0390a52
11 changed files with 44 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changes/fix-shell-open-scope.md
+7
View File
@@ -0,0 +1,7 @@
---
"shell": patch:bug
"shell-js": patch:bug
---
Apply the default open validation regex `^((mailto:\w+)|(tel:\w+)|(https?://\w+)).+` when the open configuration is not set, preventing unchecked input from being used in this scenario (previously the plugin would skip validation when it should disable all calls). This keeps backwards compatibility while still fixing this vulnerability.
The scope is no longer validated for Rust calls via `ShellExt::shell()` so if you need to block JavaScript from calling the API you can simply set `tauri.conf.json > plugins > shell > open` to `false`.