refactor: move data-url usage behind window-data-url feature

core/tauri/Cargo.toml

@@ -76,7 +76,7 @@ futures-lite = "1.12"
 epi = { git = "https://github.com/wusyong/egui", branch = "tao", optional = true }
 regex = "1.5"
 glob = "0.3"
-data-url = "0.1"
+data-url = { version = "0.1", optional = true }
 serialize-to-javascript = { git = "https://github.com/chippers/serialize-to-javascript" }
 
 [target."cfg(any(target_os = \"linux\", target_os = \"dragonfly\", target_os = \"freebsd\", target_os = \"openbsd\", target_os = \"netbsd\"))".dependencies]
@@ -122,6 +122,7 @@ cli = ["clap"]
 system-tray = ["tauri-runtime/system-tray", "tauri-runtime-wry/system-tray"]
 dox = ["tauri-runtime-wry/dox"]
 macos-private-api = ["tauri-runtime/macos-private-api", "tauri-runtime-wry/macos-private-api"]
+window-data-url = ["data-url"]
 api-all = [
   "clipboard-all",
   "dialog-all",

core/tauri/src/error.rs

@@ -103,6 +103,9 @@ pub enum Error {
   #[cfg(feature = "isolation")]
   #[error("isolation pattern error: {0}")]
   IsolationPattern(#[from] tauri_utils::pattern::isolation::Error),
+  /// An invalid window URL was provided. Includes details about the error.
+  #[error("invalid window url: {0}")]
+  InvalidWindowUrl(&'static str),
 }
 
 impl From<serde_json::Error> for Error {

core/tauri/src/lib.rs

@@ -23,6 +23,7 @@
 //! - **system-tray**: Enables application system tray API. Enabled by default if the `systemTray` config is defined on the `tauri.conf.json` file.
 //! - **macos-private-api**: Enables features only available in **macOS**'s private APIs, currently the `transparent` window functionality and the `fullScreenEnabled` preference setting to `true`. Enabled by default if the `tauri > macosPrivateApi` config flag is set to `true` on the `tauri.conf.json` file.
 //! - **egui**: Enables method to create a native egui window. This can be used for creating native OpenGL contexts or [egui](https://github.com/emilk/egui) widgets.
+//! - **window-data-url**: Enables usage of data URLs on the webview.
 //!
 //! ## Cargo allowlist features
 //!

core/tauri/src/manager.rs

@@ -21,7 +21,7 @@ use tauri_macros::default_runtime;
 use tauri_utils::pattern::isolation::RawIsolationPayload;
 use tauri_utils::{
   assets::{AssetKey, CspHash},
-  html::{inject_csp, parse as parse_html, SCRIPT_NONCE_TOKEN, STYLE_NONCE_TOKEN},
+  html::{SCRIPT_NONCE_TOKEN, STYLE_NONCE_TOKEN},
 };
 
 #[cfg(target_os = "windows")]
@@ -924,6 +924,7 @@ impl<R: Runtime> WindowManager<R> {
     if self.windows_lock().contains_key(&pending.label) {
       return Err(crate::Error::WindowLabelAlreadyExists(pending.label));
     }
+    #[allow(unused_mut)] // mut url only for the data-url parsing
     let (is_local, mut url) = match &pending.webview_attributes.url {
       WindowUrl::App(path) => {
         let url = self.get_url();
@@ -945,6 +946,14 @@ impl<R: Runtime> WindowManager<R> {
       _ => unimplemented!(),
     };
 
+    #[cfg(not(feature = "window-data-url"))]
+    if url.scheme() == "data" {
+      return Err(crate::Error::InvalidWindowUrl(
+        "data URLs are not supported without the `window-data-url` feature.",
+      ));
+    }
+
+    #[cfg(feature = "window-data-url")]
     if let Some(csp) = self.csp() {
       if url.scheme() == "data" {
         if let Ok(data_url) = data_url::DataUrl::process(url.as_str()) {
@@ -952,8 +961,8 @@ impl<R: Runtime> WindowManager<R> {
           let html = String::from_utf8_lossy(&body).into_owned();
           // naive way to check if it's an html
           if html.contains('<') && html.contains('>') {
-            let mut document = parse_html(html);
-            inject_csp(&mut document, &csp);
+            let mut document = tauri_utils::html::parse(html);
+            tauri_utils::html::inject_csp(&mut document, &csp);
             url.set_path(&format!("text/html,{}", document.to_string()));
           }
         }