OwnCord

mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00

Files

T

J3vb 2511af345e docs: design note for narrowing Tauri HTTP capabilities

Investigates whether the https wildcard on the three http:allow-fetch*
identifiers can be enumerated now that the HTTP TOFU proxy has landed.

Two findings change the answer:

- Only http:allow-fetch is URL-scoped. tauri-plugin-http validates the URL
  in the `fetch` command only; `fetch_send` and `fetch_read_body` take a
  ResourceId and never consult a scope, and Tauri's ACL resolver keeps a
  command-declaring permission's scope as command scope. The allow blocks
  on the other two identifiers are inert.
- The host set is not enumerable: api.ts, profiles.ts and attachments.ts
  are loopback-only (attachment URLs are always server-generated
  /api/v1/files/<id>) and media.ts hits one fixed YouTube oEmbed URL, but
  embeds.ts fetches arbitrary user-posted URLs by design.

Decision: keep the https wildcard with a loopback deny list, drop the two
inert scope blocks, and record the Rust-side link-preview command as the
follow-up that would actually make the set enumerable. Residual risk
(CSP connect-src already allows https:) stated explicitly.

2026-07-20 14:45:34 +02:00

audit-2026-07-19-decisions.md

docs: close audit items 3 and 11 (channel-visibility + V2 dispatch)

2026-07-20 11:44:32 +02:00

channel-visibility-unification.md

docs: close audit items 3 and 11 (channel-visibility + V2 dispatch)

2026-07-20 11:44:32 +02:00

http-tofu-proxy.md

feat(client): TOFU HTTP proxy for REST — close audit A-2026-07-02 (D5)

2026-07-19 14:26:25 +00:00

security-hardening-remediation.md

docs(plans): remediation plan for security-hardening review regressions