mirror of
https://github.com/HuLaSpark/HuLa.git
synced 2026-10-25 18:01:32 +08:00
gqxx408
3f29448030
- tauri.conf.json: replace csp:null with a restrictive CSP (blocks eval/inline scripts) - capabilities: remove unused shell:allow-execute (RCE enabler) and sql:allow-execute - capabilities: scope fs permissions to app/user directories instead of '**' - oauth_command: per-session secret validation to block token injection - useLogin: embed secret in OAuth redirectUri - configuration: sanitize DB filename (path traversal) + SQLCipher key plumbing - im_request_client: externalize hardcoded Basic-Auth secret via HULA_IM_BASIC_AUTH - websocket/client: redact auth token from logs - markdown_command: confine image/file paths within allowed roots - upload_command: forbid absolute paths, confine to AppCache/AppData, https-only - Bot.vue: sanitizeMarkdown safe-by-default; validate link schemes
265 lines
6.2 KiB
JSON
Vendored
265 lines
6.2 KiB
JSON
Vendored
{
|
|
"$schema": "../gen/schemas/desktop-schema.json",
|
|
"identifier": "default-capability",
|
|
"description": "Capability for the main window",
|
|
"platforms": ["macOS", "windows", "linux"],
|
|
"windows": [
|
|
"*"
|
|
],
|
|
"permissions": [
|
|
"core:default",
|
|
"core:window:default",
|
|
"core:window:allow-create",
|
|
"core:window:allow-start-dragging",
|
|
"core:window:allow-close",
|
|
"core:window:allow-hide",
|
|
"core:window:allow-center",
|
|
"core:window:allow-show",
|
|
"core:window:allow-maximize",
|
|
"core:window:allow-minimize",
|
|
"core:window:allow-destroy",
|
|
"core:window:allow-is-focused",
|
|
"core:window:allow-is-fullscreen",
|
|
"core:window:allow-set-focus",
|
|
"core:window:allow-set-position",
|
|
"core:window:allow-scale-factor",
|
|
"core:window:allow-unminimize",
|
|
"core:window:allow-set-always-on-top",
|
|
"core:window:allow-set-size",
|
|
"core:window:allow-set-min-size",
|
|
"core:window:allow-unmaximize",
|
|
"core:window:allow-set-fullscreen",
|
|
"core:window:allow-request-user-attention",
|
|
"core:window:allow-set-enabled",
|
|
"core:window:allow-set-theme",
|
|
"core:window:allow-theme",
|
|
"core:webview:allow-create-webview",
|
|
"core:webview:allow-create-webview-window",
|
|
"core:webview:allow-internal-toggle-devtools",
|
|
"core:webview:allow-set-webview-size",
|
|
"core:webview:allow-set-webview-position",
|
|
"core:webview:allow-webview-size",
|
|
"core:webview:allow-webview-close",
|
|
"core:event:default",
|
|
"core:event:allow-listen",
|
|
"core:image:default",
|
|
"core:image:allow-rgba",
|
|
"os:default",
|
|
"os:allow-os-type",
|
|
"os:allow-arch",
|
|
"os:allow-version",
|
|
"os:allow-hostname",
|
|
"process:default",
|
|
"process:allow-exit",
|
|
"clipboard-manager:allow-clear",
|
|
"clipboard-manager:allow-read-image",
|
|
"clipboard-manager:allow-read-text",
|
|
"clipboard-manager:allow-write-html",
|
|
"clipboard-manager:allow-write-image",
|
|
"clipboard-manager:allow-write-text",
|
|
"http:allow-fetch",
|
|
"http:allow-fetch-cancel",
|
|
"http:allow-fetch-read-body",
|
|
"http:allow-fetch-send",
|
|
"core:tray:default",
|
|
"core:tray:allow-get-by-id",
|
|
"autostart:allow-enable",
|
|
"autostart:allow-disable",
|
|
"autostart:allow-is-enabled",
|
|
"dialog:default",
|
|
"dialog:allow-open",
|
|
"dialog:allow-confirm",
|
|
"dialog:allow-save",
|
|
"dialog:allow-ask",
|
|
"dialog:allow-message",
|
|
"core:resources:allow-close",
|
|
"sql:allow-load",
|
|
"sql:allow-select",
|
|
"sql:allow-close",
|
|
"shell:default",
|
|
"shell:allow-open",
|
|
"notification:allow-is-permission-granted",
|
|
"notification:allow-request-permission",
|
|
"notification:allow-notify",
|
|
"notification:allow-register-action-types",
|
|
"notification:allow-register-listener",
|
|
"notification:allow-cancel",
|
|
"notification:allow-get-pending",
|
|
"notification:allow-remove-active",
|
|
"notification:allow-get-active",
|
|
"notification:allow-check-permissions",
|
|
"notification:allow-show",
|
|
"notification:allow-batch",
|
|
"notification:allow-list-channels",
|
|
"notification:allow-delete-channel",
|
|
"notification:allow-create-channel",
|
|
"notification:allow-permission-state",
|
|
"opener:default",
|
|
"opener:allow-reveal-item-in-dir",
|
|
"opener:allow-open-path",
|
|
{
|
|
"identifier": "opener:allow-open-url",
|
|
"allow": [
|
|
{
|
|
"url": "x-apple.systempreferences:*"
|
|
},
|
|
{
|
|
"url": "ms-settings:*"
|
|
}
|
|
]
|
|
},
|
|
"mic-recorder:default",
|
|
"log:default",
|
|
"log:allow-log",
|
|
{
|
|
"identifier": "fs:write-files",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-mkdir",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:read-dirs",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:read-files",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-copy-file",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-read-text-file",
|
|
"allow": [
|
|
{
|
|
"path": [
|
|
"$APPCONFIG/**",
|
|
"$APPDATA/**",
|
|
"$APPLOCALDATA/**",
|
|
"$APPCACHE/**",
|
|
"$APPLOG/**",
|
|
"$RESOURCE/**",
|
|
"$TEMP/**",
|
|
"$DOWNLOAD/**",
|
|
"$DOCUMENT/**",
|
|
"$PICTURE/**",
|
|
"$VIDEO/**",
|
|
"$MUSIC/**",
|
|
"$PUBLIC/**"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:default",
|
|
"allow": [
|
|
{
|
|
"url": "http://**"
|
|
},
|
|
{
|
|
"url": "https://**"
|
|
},
|
|
{
|
|
"url": "http://*:*"
|
|
},
|
|
{
|
|
"url": "https://*:*"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|