mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vb
2511af345e
Investigates whether the https wildcard on the three http:allow-fetch* identifiers can be enumerated now that the HTTP TOFU proxy has landed. Two findings change the answer: - Only http:allow-fetch is URL-scoped. tauri-plugin-http validates the URL in the `fetch` command only; `fetch_send` and `fetch_read_body` take a ResourceId and never consult a scope, and Tauri's ACL resolver keeps a command-declaring permission's scope as command scope. The allow blocks on the other two identifiers are inert. - The host set is not enumerable: api.ts, profiles.ts and attachments.ts are loopback-only (attachment URLs are always server-generated /api/v1/files/<id>) and media.ts hits one fixed YouTube oEmbed URL, but embeds.ts fetches arbitrary user-posted URLs by design. Decision: keep the https wildcard with a loopback deny list, drop the two inert scope blocks, and record the Rust-side link-preview command as the follow-up that would actually make the set enumerable. Residual risk (CSP connect-src already allows https:) stated explicitly.