mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vb
352b7c8cc1
Add a deny list for https loopback literals (localhost, 127.0.0.1, both with and without an explicit port) to `http:allow-fetch`. All legitimate server traffic reaches loopback over http through the Rust TOFU proxy, so an https loopback fetch from the renderer can only be an attempt to probe some other local service. `deny` wins over `allow` in Tauri's scope check. Drop the scope objects from `http:allow-fetch-send` and `http:allow-fetch-read-body`, leaving bare identifiers. tauri-plugin-http validates the URL exactly once, in the `fetch` command; both of these take an already-validated ResourceId and never consult a scope, and a permission declaring `commands.allow` contributes command scope only — it never merges into the plugin's global scope. The blocks were inert configuration that read like defence in depth. The capability description now records why, so they are not re-added on reflex. The `https://*` wildcard on `http:allow-fetch` stays: link previews fetch arbitrary user-posted URLs by design, and Tauri scopes per command, not per JS caller. See docs/plans/tauri-capability-narrowing.md. Add tests/unit/capabilities-scope.test.ts as a regression guard on the shape of the grant.