Skip to content

Commit c8a30a6

Browse files
fix(core): capability filtering crashing allowed command generation (#13476)
* fix(core): capability filtering crashing allowed command generation tauri-plugin and tauri build scripts cannot have access to the capabilities file (generated by tauri-build) and can only infer capabilities from the config path * cleanup * unused import * followup * fix reassign * mut * Update crates/tauri-utils/src/acl/build.rs Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> --------- Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com>
1 parent 650c91c commit c8a30a6

File tree

8 files changed

+30
-22
lines changed

8 files changed

+30
-22
lines changed

.changes/fix-capability-filter.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"tauri-utils": patch:bug
3+
---
4+
5+
Fix capability filtering via `tauri.conf.json > app > security > capabilities` not working when generating allowed commands.

crates/tauri-build/src/acl.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -437,7 +437,7 @@ pub fn build(out_dir: &Path, target: Target, attributes: &Attributes) -> super::
437437
permissions_map.insert(APP_ACL_KEY.to_string(), app_acl.permission_files);
438438
}
439439

440-
tauri_utils::acl::build::generate_allowed_commands(out_dir, permissions_map)?;
440+
tauri_utils::acl::build::generate_allowed_commands(out_dir, Some(capabilities), permissions_map)?;
441441

442442
Ok(())
443443
}

crates/tauri-build/src/lib.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,8 @@ impl Attributes {
367367

368368
/// Set the glob pattern to be used to find the capabilities.
369369
///
370+
/// **WARNING:** The `removeUnusedCommands` option does not work with a custom capabilities path.
371+
///
370372
/// **Note:** You must emit [rerun-if-changed] instructions for your capabilities directory.
371373
///
372374
/// [rerun-if-changed]: https://doc.rust-lang.org/cargo/reference/build-scripts.html#rerun-if-changed

crates/tauri-codegen/src/context.rs

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -393,9 +393,16 @@ pub fn context_codegen(data: ContextData) -> EmbeddedAssetsResult<TokenStream> {
393393
};
394394

395395
let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME);
396+
let capabilities_from_files = if capabilities_file_path.exists() {
397+
let capabilities_json =
398+
std::fs::read_to_string(&capabilities_file_path).expect("failed to read capabilities");
399+
serde_json::from_str(&capabilities_json).expect("failed to parse capabilities")
400+
} else {
401+
Default::default()
402+
};
396403
let capabilities = get_capabilities(
397404
&config,
398-
Some(&capabilities_file_path),
405+
capabilities_from_files,
399406
additional_capabilities.as_deref(),
400407
)
401408
.unwrap();

crates/tauri-plugin/src/build/mod.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ impl<'a> Builder<'a> {
137137

138138
let mut permissions_map = BTreeMap::new();
139139
permissions_map.insert(name.clone(), permissions);
140-
tauri_utils::acl::build::generate_allowed_commands(&out_dir, permissions_map)?;
140+
tauri_utils::acl::build::generate_allowed_commands(&out_dir, None, permissions_map)?;
141141

142142
if let Some(global_scope_schema) = self.global_scope_schema {
143143
acl::build::define_global_scope_schema(global_scope_schema, &name, &out_dir)?;

crates/tauri-utils/src/acl/build.rs

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,7 @@ pub fn generate_docs(
393393
/// Generate allowed commands file for the `generate_handler` macro to remove never allowed commands
394394
pub fn generate_allowed_commands(
395395
out_dir: &Path,
396+
capabilities_from_files: Option<BTreeMap<String, Capability>>,
396397
permissions_map: BTreeMap<String, Vec<PermissionFile>>,
397398
) -> Result<(), anyhow::Error> {
398399
println!("cargo:rerun-if-env-changed={REMOVE_UNUSED_COMMANDS_ENV_VAR}");
@@ -419,11 +420,6 @@ pub fn generate_allowed_commands(
419420
println!("cargo:rerun-if-changed={}", capabilities_path.display());
420421
}
421422

422-
let mut capabilities = crate::acl::build::parse_capabilities(&format!(
423-
"{}/**/*",
424-
glob::Pattern::escape(&capabilities_path.to_string_lossy())
425-
))?;
426-
427423
let target_triple = env::var("TARGET")?;
428424
let target = crate::platform::Target::from_triple(&target_triple);
429425
let (mut config, config_paths) = crate::config::parse::read_from(target, &config_directory)?;
@@ -460,7 +456,15 @@ pub fn generate_allowed_commands(
460456
})
461457
.collect();
462458

463-
capabilities.extend(crate::acl::get_capabilities(&config, None, None)?);
459+
let capabilities_from_files = if let Some(capabilities) = capabilities_from_files {
460+
capabilities
461+
} else {
462+
crate::acl::build::parse_capabilities(&format!(
463+
"{}/**/*",
464+
glob::Pattern::escape(&capabilities_path.to_string_lossy())
465+
))?
466+
};
467+
let capabilities = crate::acl::get_capabilities(&config, capabilities_from_files, None)?;
464468

465469
let permission_entries = capabilities
466470
.into_iter()

crates/tauri-utils/src/acl/mod.rs

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ use std::{
2828
collections::{BTreeMap, HashSet},
2929
fs,
3030
num::NonZeroU64,
31-
path::{Path, PathBuf},
31+
path::PathBuf,
3232
str::FromStr,
3333
sync::Arc,
3434
};
@@ -352,19 +352,9 @@ pub fn has_app_manifest(acl: &BTreeMap<String, crate::acl::manifest::Manifest>)
352352
/// Get the capabilities from the config file
353353
pub fn get_capabilities(
354354
config: &Config,
355-
pre_built_capabilities_file_path: Option<&Path>,
355+
mut capabilities_from_files: BTreeMap<String, Capability>,
356356
additional_capability_files: Option<&[PathBuf]>,
357357
) -> anyhow::Result<BTreeMap<String, Capability>> {
358-
let mut capabilities_from_files: BTreeMap<String, Capability> = BTreeMap::new();
359-
if let Some(capabilities_file_path) = pre_built_capabilities_file_path {
360-
if capabilities_file_path.exists() {
361-
let capabilities_file =
362-
std::fs::read_to_string(capabilities_file_path).context("failed to read capabilities")?;
363-
capabilities_from_files =
364-
serde_json::from_str(&capabilities_file).context("failed to parse capabilities")?;
365-
}
366-
}
367-
368358
let mut capabilities = if config.app.security.capabilities.is_empty() {
369359
capabilities_from_files
370360
} else {

crates/tauri/build.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,7 @@ fn main() {
350350
}
351351

352352
let permissions = define_permissions(&out_dir);
353-
tauri_utils::acl::build::generate_allowed_commands(&out_dir, permissions).unwrap();
353+
tauri_utils::acl::build::generate_allowed_commands(&out_dir, None, permissions).unwrap();
354354
}
355355

356356
const LICENSE_HEADER: &str = r"# Copyright 2019-2024 Tauri Programme within The Commons Conservancy

0 commit comments

Comments
 (0)