chore(deps): update rust crate tauri to v2.0.0-beta.20 [security] #6
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
11b3af2 to
64915eb
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.0.0-beta.14->2.0.0-beta.20GitHub Vulnerability Alerts
CVE-2024-35222
Impact
Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the
dangerousRemoteDomainIpcAccessin v1 and in thecapabilitiesin v2.This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window.
For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application.
Patches
The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems.
This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same.
We have also added a new protection mechanism to the IPC layer to protect against iFrames directly using the WebView IPC functionality (e.g. via
window.ipc.postMessage).This introduces an invoke key (
__TAURI_INVOKE_KEY__) which is used to prevent frames that have not been initialized by the Tauri core from sending messages to the Tauri IPC.This key is not used to protect against compromised Tauri windows or WebViews and is only intended to block IPC access from sub-frames.
Unauthorized messages to the Tauri IPC from an iFrame or other non-initialized context will log a warning and the potentially malicious IPC call will be ignored.
Workarounds
These workarounds should only be considered if you are unable to upgrade to the patched Tauri version in time.
As a workaround for v1 Tauri applications, we recommend using a dedicated window for untrusted origins instead of iFrames, or disabling script execution within the iFrame.
For v2 Tauri applications targeting Linux, it is possible to use either a dedicated window or multiple WebViews in the main window to simulate iFrame behavior.
On other platforms, it is only possible to use dedicated windows or disable script execution inside the iFrame, as described for v1.
References
If you have any questions or comments about this advisory:
Open an issue in tauri or
Email us at security@tauri.app
The original submissions from the reporter:
Release Notes
tauri-apps/tauri (tauri)
v2.0.0-beta.20: tauri v2.0.0-beta.20Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.20]
New Features
ae6b13dfc(#9789) Addapp-region: dragto HTML elements withdata-tauri-drag-regionon Windows, only WebView2 123+, which should fix dragging using touch.ec0e092ec(#9770) AddApp/AppHandle/Window/Webview/WebviewWindow::monitor_from_point(x, y)getter to get the monitor from a given point.Enhancements
5d20530c9(#9842) AddedAppHandle::set_activation_policyfor macOS.Bug Fixes
0b690f242(#9845) Exporttauri::UriSchemeResponder.Security fixes
d950ac123Only process IPC commands from the main frame.Dependencies
tauri-utils@2.0.0-beta.16tauri-runtime-wry@2.0.0-beta.17tauri-runtime@2.0.0-beta.17tauri-macros@2.0.0-beta.16tauri-build@2.0.0-beta.16Cargo Publish
v2.0.0-beta.19: tauri v2.0.0-beta.19Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.19]
New Features
78839b6d2(#4865) AddRunEvent::Reopenfor handle click on dock icon on macOS.Bug Fixes
fedca7386(#9720) Fix IPC tracing format incompatible between the custom protocol and the postMessage implementations.Dependencies
tauri-runtime@2.0.0-beta.16tauri-runtime-wry@2.0.0-beta.16tauri-utils@2.0.0-beta.15tauri-macros@2.0.0-beta.15tauri-build@2.0.0-beta.15Breaking Changes
783ef0f2d(#9647) ChangedWebviewWindow::urlandWebview::urlgetter to return a result.Cargo Publish
v2.0.0-beta.18: tauri v2.0.0-beta.18Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.18]
New Features
07ff78c2d(#9615) AddTrayIcon::rectmethod to retrieve the tray icon rectangleEnhancements
7f6d2698c(#9631) Improve the error message that is shown when deserializing the Tauri plugin config.8a71858eb(#9630) Provide a default for the runtime generic onMenu,MenuItem,Submenu,PredefinedMenuItem,CheckMenuItemandIconMenuItem.8a71858eb(#9630) Provide a default for the runtime generic onTrayIcon.Dependencies
tauri-utils@2.0.0-beta.14tauri-runtime@2.0.0-beta.15tauri-runtime-wry@2.0.0-beta.15tauri-macros@2.0.0-beta.14tauri-build@2.0.0-beta.14Cargo Publish
v2.0.0-beta.17: tauri v2.0.0-beta.17Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.17]
New Features
12b4159bd(#9392) Addspectafeature flag which addsspectasupport forAppHandle,State,Window,WebviewandWebviewWindowtypes.477bb8cd4(#9297) AddApp/AppHandle/Window/Webview/WebviewWindow::cursor_positiongetter to get the current cursor position.Enhancements
eff778b8f(#9571) Run each plugin initialization script on its own context so they do not interfere with each other or the Tauri init script.Bug Fixes
6c047aee1(#9612) Fix window white flashing on exit on Windows98101cb17(#9561) Allow any headers on the IPC custom protocol.Dependencies
tauri-runtime@2.0.0-beta.14tauri-runtime-wry@2.0.0-beta.14Cargo Publish