rules-tauri

RISK: allowlist.all:true grants EVERY Tauri built-in plugin (shell, fs, http, clipboard, process, global-shortcut …) to the WebView, turning a DOM XSS or supply-chain compromise into a full OS takeover (CWE-250). FIX: enumerate only the specific plugins your app needs (e.g. allowlist.shell.open:true) and set sane scopes on each.

RISK: setting CSP to null disables Tauri's default Content Security Policy entirely, removing the browser-engine-level barrier against XSS and injected scripts. With null CSP any injected script can call window.__TAURI__ if withGlobalTauri is on, or exfiltrate data via fetch (CWE-79). FIX: keep the default CSP or write an explicit policy; at minimum keep default-src 'self' tauri: ipc:.

RISK: fs scope ** or **/* grants the WebView unrestricted access to the entire filesystem — identical in impact to dropping the capability system entirely (CWE-22). FIX: enumerate specific app data directories (e.g. $APPDATA/app-name/**, $TMPDIR/app-name/**) and never use a root-anchored glob.

RISK: fs scope $HOME/** gives the WebView read/write access to the user's entire home directory, including SSH keys, browser profiles, shell configs, and application secrets. Any XSS or supply-chain compromise in your frontend can exfiltrate ~/.ssh/id_rsa or write ~/.bashrc (CWE-22). FIX: restrict fs scope to the minimal subdirectory your app actually needs, e.g. $APPDATA/my-app/**.

RISK: dangerousRemoteDomainIpcAccess exposes Tauri's IPC bridge to remote origins, letting any attacker-controlled web page invoke your #[tauri::command] handlers as if it were your app's own frontend. This is an intentional security boundary removal. FIX: never enable this option; serve all app content from tauri:// or asset:// origins.

RISK: loading a remote HTTP/HTTPS URL as the main Tauri window turns your desktop app into a browser tab with Tauri IPC attached. Any XSS on that remote page, DNS hijack, or CDN compromise gains access to all Tauri capabilities you granted (fs, shell, clipboard, etc.). FIX: serve your frontend as a static bundle using tauri://localhost (frontendDist) so the window origin is always tauri:// and the content is under your control.

RISK: passing caller-supplied or user-controlled input directly to tauri::api::shell::open() allows protocol-handler injection and command injection on Windows (where open() dispatches to ShellExecuteW with the raw string). An attacker who can influence the argument can launch local executables or exfiltrate data via custom URI schemes (CWE-78). FIX: validate the URL against an allowlist of known-safe schemes (https:, mailto:) and origins before calling shell::open(); never pass IPC-received strings directly.

RISK: shell.all:true allows the WebView to spawn any process, open any URL, and execute any sidecar — equivalent to a remote-code-execution foothold from XSS (CWE-78). FIX: set shell.open:true only if you need URL launching, restrict shell.scope to an explicit allowlist of executables with fixed argument patterns.

RISK: enabling the Tauri updater without a pubkey disables signature verification on update bundles — any MITM or compromised update server can push an unsigned payload that silently replaces your binary (CWE-494, supply-chain RCE). FIX: generate an Ed25519 keypair with `tauri signer generate`, embed the public key in updater.pubkey, and sign every release artifact with the private key.

RISK: a #[tauri::command] handler that accepts a path argument and passes it directly to filesystem operations allows path-traversal attacks from the WebView — the frontend (or any XSS in it) can read /etc/passwd or write outside the app sandbox by sending ../../ sequences (CWE-22). FIX: canonicalize the incoming path with std::fs::canonicalize(), then assert it starts_with() your expected app data directory before performing any I/O.

RISK: script-src 'unsafe-inline' in the Tauri CSP defeats inline-script blocking, allowing XSS payloads injected into the DOM to execute directly (CWE-79). FIX: remove 'unsafe-inline'; hash or nonce individual inline scripts that are truly necessary, or move them to bundled JS files served from tauri://.

RISK: http.all:true lets the WebView make fetch/XHR requests to any URL via Tauri's HTTP plugin, bypassing the Content Security Policy connect-src restriction and allowing exfiltration of local data to attacker-controlled servers. FIX: enumerate allowed origins in http.scope (e.g. ["https://api.example.com/*"]) and leave http.all:false.

RISK: enabling process.relaunch or process.exit in the allowlist lets the WebView terminate or restart the host process on demand. In combination with any XSS or supply-chain attack, an adversary can perform a denial-of-service against the desktop app or force a restart to pick up a malicious file written moments before (CWE-400). FIX: only enable these capabilities if the app genuinely needs user-initiated quit/relaunch; gate calls behind an explicit user confirmation in the frontend.

RISK: withGlobalTauri:true injects the full window.__TAURI__ API into every script in the WebView, including third-party JS loaded from CDNs or NPM packages. A single compromised dependency gains read access to the filesystem, shell, and clipboard scopes you granted (CWE-250). FIX: leave withGlobalTauri:false (the default) and import @tauri-apps/api explicitly from your own bundled code only.