Checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend.
Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.
* feat(updater): verify the version an update was signed for
The endpoint response is fetched over TLS but is not signed, and the signature
only covers the artifact, so a crafted response could pair an inflated version
with an older release's url and signature to force a downgrade to a genuine
but outdated build.
Read the version back from the signature's trusted comment and reject an
update whose announced version differs. Signatures carrying no version are
only rejected under the new requireSignedVersion option, since older CLIs did
not record one.
* fix tests
* fix(http): stop unhandled rejections from the fetch cleanup path
The request/body cleanup commands are fired as floating promises, and the
Rust side releases a resource only once: fetch_cancel_body is
resources_table.close(rid)?, and fetch_read_body also closes the rid at
end-of-body. So every release after the first rejects with BadResourceId
into a promise nobody is listening to.
Make dropBody idempotent and let both cleanup calls handle their own
rejection.
* chore: add changefile
* chore(http): rebuild api-iife.js
* fix(android): missing `consumer-rules.pro`
* setup android test
* copy right too new
* build api first
* we're still on gradle 8 right now...
* restore the right host on mac
* feat(updater): option to not restart after install
* More platform cfg
* Add the same function for `UpdaterBuilder`
* Fix missing `#[cfg(windows)]`
* Mark `current_exe_args` cfg(windows)
* Mark `on_before_exit` cfg(windows)
* Mark `installer_args` cfg(windows)
* Note about `installer_arg` apply to both
* Remove current args and restart together
* Only build needed bundle on windows as well
* Remove `/NS` since it breaks the msi updater
* Add launch updater debug log
* Add a folder to test updates
* Remove unused `#[allow(unused)]`
* Format
* messed up git stage
* Add change file
* Clean up
* Disable NSIS compression for API example
* Bump wry for v1 test to pull in https://github.com/tauri-apps/wry/pull/1703
* format
* Make typescript happy
* Close new update on destroy
* Fix example insets
* Add app-region: drag
* Use `Theme.Material3.DayNight.NoActionBar`
* Re-generate some kotlin files
* Use MaterialAlertDialogBuilder
* Add change file
* Revert back to margin-top: 0.5rem
* Re-generate outdated gradle wrapper from #3039
* Move title bar to its own file
* Fix cancel message
* Use tokio UnixListener so the task can yield and release the thread
* use standard unix listener, convert to non blocking and cast into tokio yielding one
* Create fix-yield-single-instance-macos.md
* Update .changes/fix-yield-single-instance-macos.md
Co-authored-by: Fabian-Lars <30730186+FabianLars@users.noreply.github.com>
* use net feature in Tokio dependency
* Use tokio UnixListener::bind, inside the tokio task
---------
Co-authored-by: Fabian-Lars <30730186+FabianLars@users.noreply.github.com>
* fix: preserve file extension of updated package (fix: #3283)
Otherwise users may get confused when seing a sudo dialog
which suggests a `rpm` package is installed using `dpkg -i`
* pass on package extension more thoroughly
* add changes file
Update the updater package to preserve file extension, clarifying installation prompts for users.
* Apply suggestion from @hrzlgnm
* Apply suggestion from @hrzlgnm
* Apply suggestion from @Legend-Master
* More rpm and log `pkg_path` instead
---------
Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com>
Co-authored-by: Tony <legendmastertony@gmail.com>
* chore(dialog): reuse `message` command for confirm
* Add change file
* Remove ask and confirm from default permissions
* Format
* Remove extra `toString`
* Point `allow-confirm` to `allow-message`
Previously, headers were patched onto the Response object after construction, which bypassed the internal header list and caused `response.clone().headers` to be empty. This change passes the headers directly to the Response constructor, ensuring they are properly stored and clonable.
Lucas Fernandes Nogueira