Tauri Security Review

□ identifier is unique and descriptive
□ windows / webviews are explicitly listed (no broad globs unless justified)
□ permissions list is minimal — every entry has a justified use case
□ fs/shell/http permissions use scoped objects with allow path lists
□ allow paths use Tauri path vars ($APPDATA, etc.), not absolute paths
□ allow paths do NOT use ** wildcards
□ deny rules added for sensitive subpaths (secrets, .env)
□ platforms[] excludes platforms that don't need this capability
□ remote.urls (if present) is a specific allowlist, not "https://*"
□ local: false used when capability is for remote-only contexts

□ identifier prefixed with intended namespace
□ commands.allow is the smallest set possible
□ scope.allow paths are specific
□ scope.deny added for any obvious dangerous subpath
□ description explains the security impact, not just the feature

□ app.security.csp present and restrictive
   - default-src 'self'
   - no 'unsafe-inline' for script-src
   - no 'unsafe-eval' (except 'wasm-unsafe-eval' if WASM is used)
   - connect-src is a specific allowlist
□ app.security.devCsp present (or same as csp) — dev mode shouldn't relax everything
□ app.security.dangerousDisableAssetCspModification is NOT true
□ app.security.assetProtocol.scope is restrictive (not "**")
□ app.windows[].url is local (path) or trusted https — not http or untrusted host
□ build.devUrl is localhost only
□ identifier is reverse-DNS and matches the App Store record
□ plugins.shell.open is restrictive or absent
□ plugins.http.scope (if used) lists exact allowed origins

□ All path inputs validated:
   - canonicalize() to resolve symlinks
   - check that resolved path is inside an expected base dir
   - reject paths containing ".." segments or null bytes
□ Shell-bound inputs never concatenated — use std::process::Command with args[], not args.join(" ")
□ SQL inputs parameterized (never format!())
□ HTTP URLs validated to be in expected origin set
□ Input length bounded — no infinite-size strings/bytes accepted
□ Errors don't leak sensitive paths or stack traces (use a typed error enum that rewrites messages)
□ No unwrap()/expect() — they panic and crash the app
□ Async commands don't hold std::sync::Mutex across .await
□ No use of std::env::set_var (security side effects across threads)

□ Single tauri::generate_handler![...] call (multiple calls silently overwrite)
□ All commands listed actually exist as #[tauri::command]
□ No leftover/dead command registrations exposing unused attack surface

□ User input never used as an `invoke` command name (must be a hardcoded string literal)
□ Argument types match the Rust signature exactly
□ Error from invoke is caught and shown safely (not innerHTML'd into DOM — XSS)

// ❌ WRONG — frontend can read/write anywhere in $HOME
{
  "identifier": "main",
  "windows": ["main"],
  "permissions": [
    { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$HOME/**" }] }
  ]
}

// ✅ CORRECT — narrowly scoped to app data
{
  "identifier": "main",
  "windows": ["main"],
  "permissions": [
    { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$APPDATA/notes/*" }] }
  ]
}

// ❌ WRONG — frontend can escape with "../../../etc/passwd"
#[tauri::command]
async fn read_note(name: String, app: AppHandle) -> Result<String, NoteError> {
    let dir = app.path().app_data_dir()?;
    let path = dir.join(&name);
    Ok(tokio::fs::read_to_string(&path).await?)
}

// ✅ CORRECT — canonicalize and verify containment
#[tauri::command]
async fn read_note(name: String, app: AppHandle) -> Result<String, NoteError> {
    let dir = app.path().app_data_dir()?.canonicalize()?;
    let path = dir.join(&name).canonicalize()?;
    if !path.starts_with(&dir) {
        return Err(NoteError::InvalidPath);
    }
    Ok(tokio::fs::read_to_string(&path).await?)
}

// ❌ WRONG — RCE if `query` contains "; rm -rf ~"
#[tauri::command]
fn search(query: String) -> Result<String, Error> {
    let out = std::process::Command::new("sh")
        .arg("-c")
        .arg(format!("grep {} ~/notes", query))
        .output()?;
    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
}

// ✅ CORRECT — pass args directly, no shell
#[tauri::command]
fn search(query: String) -> Result<String, Error> {
    if query.len() > 200 { return Err(Error::TooLong); }
    let out = std::process::Command::new("grep")
        .arg("--")            // end of options
        .arg(&query)          // safe: passed as argv, no shell parsing
        .arg(notes_dir())
        .output()?;
    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
}

// ❌ WRONG — created new window, didn't add capability — but ALSO didn't restrict commands
// New "settings" window can call EVERY command listed in invoke_handler if a wildcard capability exists
let _settings = WebviewWindowBuilder::new(&app, "settings", WebviewUrl::App("settings".into()))
    .build()?;

// ✅ CORRECT — explicit capability with minimum permissions for settings window
// src-tauri/capabilities/settings.json
{
  "identifier": "settings",
  "windows": ["settings"],
  "permissions": ["core:default", "settings:allow-read", "settings:allow-write"],
  "platforms": ["macOS"]
}

// ❌ WRONG — any reflected XSS becomes RCE via invoke()
"csp": "default-src 'self'; script-src 'self' 'unsafe-inline'"

// ✅ CORRECT — Tauri injects nonces for bundled scripts; no inline needed
"csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://api.example.com"

// ❌ WRONG — disables Tauri's automatic nonce/hash injection
"app": { "security": { "dangerousDisableAssetCspModification": true } }

// ✅ CORRECT — leave default (false). Only enable if you have a strong CSP without it.

// ❌ WRONG — full path leaks to frontend (and into logs / crash reports)
#[tauri::command]
fn open_db() -> Result<(), String> {
    std::fs::File::open("/Users/alice/secrets.db").map_err(|e| e.to_string())?;
    Ok(())
}

// ✅ CORRECT — typed error rewrites messages
#[derive(thiserror::Error, Debug)]
enum DbError {
    #[error("database unavailable")]
    Unavailable,
}
impl serde::Serialize for DbError { /* serialize as string */ }

// ❌ WRONG — loading a third-party URL into a window with all permissions
{ "label": "embed", "url": "https://untrusted.example.com/widget" }
// + capability with broad permissions for "embed" window

// ✅ CORRECT — remote content gets a separate capability with NO commands granted
{
  "identifier": "embed-readonly",
  "windows": ["embed"],
  "permissions": ["core:event:default"],  // events only, no fs/shell/etc
  "remote": { "urls": ["https://untrusted.example.com/*"] }
}

// tauri-plugin-shell's `open` is deprecated in Tauri v2; use tauri-plugin-opener.
use tauri_plugin_opener::OpenerExt;

// ❌ WRONG — "javascript:..." or arbitrary scheme
#[tauri::command]
fn open_link(url: String, app: AppHandle) {
    app.opener().open_url(&url, None::<&str>).ok();
}

// ✅ CORRECT — validate scheme + domain
#[tauri::command]
fn open_link(url: String, app: AppHandle) -> Result<(), Error> {
    let parsed = url::Url::parse(&url).map_err(|_| Error::InvalidUrl)?;
    if !matches!(parsed.scheme(), "https" | "http") { return Err(Error::InvalidScheme); }
    let host = parsed.host_str().ok_or(Error::InvalidUrl)?;
    if !["docs.example.com", "github.com"].contains(&host) { return Err(Error::DomainNotAllowed); }
    app.opener().open_url(parsed.as_str(), None::<&str>).map_err(|_| Error::OpenFailed)?;
    Ok(())
}