Wallpaper preview: canonicalize the path before allowing it in the asset scope #86

New issue

Closed

opened 2026-10-14 18:30:46 +08:00 by Breadway · 1 comment

Breadway commented

2026-10-14 18:30:46 +08:00

Owner

How it was found: independent review of PR #80 (BSET-70), comment 4819, which included a mock-runtime check against tauri 2.11.5.

Confidence: medium. Reasoned from tauri's scope behaviour and checked with a throwaway mock test, not reproduced in the app.

Explanation: breadpaper.rs allow_preview passes the current wallpaper path straight to asset_protocol_scope().allow_file(). Tauri resolves one symlink level when it checks access, so if the current wallpaper is a symlink named *.png, the webview can read the link's target. Exploiting this needs the user's own breadpaper state to point at such a link, so the risk is low. Separately, the scope only grows during an app session (nothing is revoked when the wallpaper changes), and allow_preview has no unit test.

Fix: std::fs::canonicalize the path and re-check the extension on the resolved path before allow_file. Add a mock-runtime test: an absolute existing image is allowed, its siblings are not, a symlink to a non-image is refused.

**How it was found:** independent review of PR #80 (BSET-70), comment 4819, which included a mock-runtime check against tauri 2.11.5. **Confidence:** medium. Reasoned from tauri's scope behaviour and checked with a throwaway mock test, not reproduced in the app. **Explanation:** breadpaper.rs `allow_preview` passes the current wallpaper path straight to `asset_protocol_scope().allow_file()`. Tauri resolves one symlink level when it checks access, so if the current wallpaper is a symlink named `*.png`, the webview can read the link's target. Exploiting this needs the user's own breadpaper state to point at such a link, so the risk is low. Separately, the scope only grows during an app session (nothing is revoked when the wallpaper changes), and `allow_preview` has no unit test. **Fix:** `std::fs::canonicalize` the path and re-check the extension on the resolved path before `allow_file`. Add a mock-runtime test: an absolute existing image is allowed, its siblings are not, a symlink to a non-image is refused.

Breadway commented

2026-10-20 15:31:44 +08:00

Author

Owner

PR opened: #88 (Breadway/bos-settings #88)
Head SHA: 7a712a9a2f
preview_target() canonicalizes before every check, and scope grants the resolved file. cargo test --lib: 200/200 passed (6 new breadpaper tests). Clippy -D warnings clean. Not run against a live webview. Needs independent review.

PR opened: https://git.breadway.dev/Breadway/bos-settings/pulls/88 (Breadway/bos-settings #88) Head SHA: 7a712a9a2fcce2157d33c89b7b9cdf7f764fc02f preview_target() canonicalizes before every check, and scope grants the resolved file. cargo test --lib: 200/200 passed (6 new breadpaper tests). Clippy -D warnings clean. Not run against a live webview. Needs independent review.

Breadway closed this issue

2026-10-20 17:47:56 +08:00