Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping

--- description: Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping - Enforces least-privilege IPC boundaries in Tauri 2.0 by requiring window/web-view-scoped capability manifests, explicit command allowlists, and runtime path/argument scoping. Prevents Remote Code Execution (RCE) and filesystem traversal by eliminating wildcard permissions and unvalidated native invocation bindings. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511" --- # Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Wildcard IPC Allowances and Unscoped Native Commands Exposing System Primitives to Compromised WebViews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Capability-Based Dynamic IPC Permission Sandboxing. Mandate strict adherence to explicit JSON/TOML capability files, window-specific IPC boundaries, granular command scopes, and server-side runtime validation of all IPC arguments within native Rust commands. Forbid global command exposure, wildcard permissions, and client-controlled filesystem paths. ## Strict Guidelines - Engineers MUST ALWAYS define isolated capability manifests in `src-tauri/capabilities/` targeting specific window labels rather than relying on global default permissions. - Engineers MUST ALWAYS scope plugin and native command permissions using explicit allowlists and fine-grained permission rules (e.g., `fs:allow-read-text-file` scoped to `$APP_DATA/*` instead of general filesystem access). - Engineers MUST NEVER use wildcard permissions such as `core:default` or `fs:default` across all windows, especially windows rendering external or dynamic remote content. - Rust native commands MUST ALWAYS perform secondary runtime validation and sanitization of incoming arguments using typed structs rather than generic strings or dynamic payloads. - Frontend IPC calls MUST ALWAYS use typed wrappers generated via `@tauri-apps/api/core` invoke and MUST NOT attempt raw `__TAURI_INTERNALS__` invocation or bypass the permission sandbox. ## Bad vs Good Implementations ### Configuring Window-Scoped Capabilities vs Over-Permissioned Defaults #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants complete native filesystem and arbitrary shell execution access to all windows via wildcards ('*') and default mega-permissions, allowing XSS in any web view to escalate to full host takeover. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Insecure global capability granting unrestricted access", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-all" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions exclusively to the 'main' window, restricts fs operations to read-only, and enforces strict directory scoping using the dynamic path variable $APP_DATA_DIR. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "document-viewer-capability", "description": "Scoped capability for reading user documents in the main workspace", "windows": ["main"], "permissions": [ "core:path:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APP_DATA_DIR/documents/**" } ] } ] } ``` ### Rust Command Defense-in-Depth Argument Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Bypasses Tauri capability sandboxing assumptions by performing un-scoped raw filesystem I/O directly in native code using unsanitized string inputs vulnerable to path traversal attacks. ```rust use tauri::command; use std::fs; // Bad: Accepts unvalidated arbitrary paths from frontend IPC #[command] pub fn read_custom_file(path_str: String) -> Result<String, String> { fs::read_to_string(&path_str).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Validates IPC payloads on the native Rust side, verifies canonical paths against application sandboxed storage, and prevents path traversal even if frontend capability rules are bypassed. ```rust use tauri::{command, AppHandle, Manager, Runtime}; use std::path::{Path, PathBuf}; #[command] pub async fn read_custom_file<R: Runtime>( app: AppHandle<R>, relative_path: PathBuf, ) -> Result<String, String> { // Reject absolute paths and directory traversal components if relative_path.is_absolute() || relative_path.components().any(|c| c == std::path::Component::ParentDir) { return Err("Invalid path: directory traversal prohibited".into()); } let base_dir = app.path().app_data_dir().map_err(|e| e.to_string())?; let target = base_dir.join("documents").join(relative_path); let canonical_target = target.canonicalize().map_err(|e| e.to_string())?; let canonical_base = base_dir.join("documents").canonicalize().map_err(|e| e.to_string())?; if !canonical_target.starts_with(&canonical_base) { return Err("Access denied: path outside sandbox boundary".into()); } std::fs::read_to_string(canonical_target).map_err(|e| e.to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping

Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping defines an industrial-grade behavioral standard for security engineering. Enforces least-privilege IPC boundaries in Tauri 2.0 by requiring window/web-view-scoped capability manifests, explicit command allowlists, and runtime path/argument scoping. Prevents Remote Code Execution (RCE) and filesystem traversal by eliminating wildcard permissions and unvalidated native invocation bindings. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard IPC Allowances and Unscoped Native Commands Exposing System Primitives to Compromised WebViews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard IPC Allowances and Unscoped Native Commands Exposing System Primitives to Compromised WebViews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define isolated capability manifests in `src-tauri/capabilities/` targeting specific window labels rather than relying on global default permissions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.