Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Affected: crates.io: tauri
### Impact
The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths.
Example: The `fs` scope `$HOME/*.key` would also allow `$HOME/.ssh/secret.key` to be read even though it is in a sub directory of `$HOME` and is inside a hidden folder.
Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected.
### Patches
The issue has been patched in the latest release and was backported into the currently supported 1.x branches.
### Workarounds
No workaround is known at the time of publication.
### References
The original report contained information that the `dialog.open` component automatically allows one sub directory to be read, regardless of the `recursive` option.
Imagine a file system looking like ``` o ../ o documents/ - file.txt - deeper/ o deep_file.txt ```
Reproduction steps:
1. Trying to load “file.txt” or “deep_file.txt” doesn’t work. Expected 2. Select “documents” as folder to open(ie. with window.__TAURI__.dialog.open) 3. Trying to load “file.txt” works. Expected 5. Trying to load “deep_file.txt” also works, which isn’t expected
The recursive flag is used in https://github.com/tauri-apps/tauri/blob/cd8c074ae6592303d3f6844a4fb6d262eae913b2/core/tauri/src/scope/fs.rs#L154 to scope the filesystem access to either files in the folder or to also include sub director…