mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
dc35f8ea4b
Addresses findings from comprehensive security review of the Tauri client: Critical: - Scope fs:allow-write-file from ** to $APPDATA/**,$APPLOG/** - Validate server_url scheme (https://) in update_commands.rs High: - Change CRED_PERSIST_LOCAL_MACHINE to CRED_PERSIST_ENTERPRISE (per-user) - Remove password from IPC response (#[serde(skip)] on CredentialData) - Auto-login uses stored token instead of password - Gate open_devtools behind #[cfg(feature = "devtools")] at registration - Validate remote_host for CRLF/null in livekit_proxy - Guard icons.ts innerHTML with runtime check - Add file upload MIME type allowlist - Clear pendingTotpPartialToken after use Medium: - Add sandbox attribute to YouTube iframes - Remove image/svg+xml from SAFE_MIME_TYPES - Strip trailing punctuation from linkified URLs - Validate host format in api.ts setConfig - Cap error messages at 200 chars (anti-phishing) - Rate limit search requests (500ms interval) - Validate Tenor GIF URLs against trusted origins - Sanitize notification titles (control chars + length cap) - Validate ptt_set_key vk_code range (1-254) - Add host validation to store_cert_fingerprint Docs: - Add "Client Security Hardening" section to docs/security.md
132 lines
2.6 KiB
JSON
132 lines
2.6 KiB
JSON
{
|
|
"identifier": "default",
|
|
"description": "Default capability granting core permissions to the main window",
|
|
"windows": [
|
|
"main"
|
|
],
|
|
"permissions": [
|
|
"core:default",
|
|
"core:event:default",
|
|
"core:window:default",
|
|
"core:window:allow-show",
|
|
"core:window:allow-hide",
|
|
"core:window:allow-set-focus",
|
|
"core:window:allow-is-visible",
|
|
"core:window:allow-set-position",
|
|
"core:window:allow-set-size",
|
|
"core:window:allow-maximize",
|
|
"core:window:allow-is-maximized",
|
|
"core:window:allow-outer-position",
|
|
"core:window:allow-outer-size",
|
|
"store:default",
|
|
"global-shortcut:default",
|
|
"global-shortcut:allow-register",
|
|
"global-shortcut:allow-unregister",
|
|
"global-shortcut:allow-unregister-all",
|
|
"global-shortcut:allow-is-registered",
|
|
"notification:default",
|
|
"notification:allow-notify",
|
|
"notification:allow-request-permission",
|
|
"notification:allow-is-permission-granted",
|
|
"http:default",
|
|
{
|
|
"identifier": "http:allow-fetch",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:allow-fetch-send",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:allow-fetch-read-body",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
}
|
|
]
|
|
},
|
|
"http:allow-fetch-cancel",
|
|
"opener:default",
|
|
"dialog:default",
|
|
"updater:default",
|
|
"process:allow-restart",
|
|
"fs:default",
|
|
{
|
|
"identifier": "fs:allow-write-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPDATA/**"
|
|
},
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-write-text-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-mkdir",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-exists",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-read-dir",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-remove",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-read-text-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|