Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary

--- description: Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary - Protects native core capabilities from malicious OS protocol handler injections by enforcing strict URI schema validation, origin allowlisting, and isolation boundaries before dispatching deep link payloads to privileged Tauri IPC commands. Unsanitized OS activations must never directly pass URI parameters into native plugins or arbitrary invoke handlers. globs: src/**/*.{ts,tsx}, src-tauri/src/**/*.rs, src-tauri/capabilities/**/*.json alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-deep-link-ipc-boundary-validation" --- # Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Blind Pipeline Dispatch of Unsanitized OS Protocol URIs Directly into Privileged Native IPC Invokes ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Deep Link URI Validation and IPC Isolation Boundaries. Mandate strict schema validation, cryptographic state verification, and safe dispatching patterns for OS-level protocol activations. ## Strict Guidelines - Engineers MUST ALWAYS validate incoming deep link URIs against an explicit allowlist of authorized schemes, hosts, and structured pathnames before processing. - Engineers MUST NOT forward raw, unvalidated deep link query parameters or path variables directly into Tauri `invoke()` calls or native plugins. - Code SHOULD verify cryptographic nonces or PKCE state tokens when processing deep link authentication redirects to mitigate protocol-hijacking attacks. - Services MUST route deep link activations through an isolated dispatcher layer that maps strictly defined URI schemas to strongly typed, parameter-bounded frontend commands. - Components NEVER execute identity-mutating, file-system modifying, or native shell commands directly from an automated deep-link event without explicit user confirmation or re-authentication. ## Bad vs Good Implementations ### Deep Link Dispatcher: Unsafe Direct IPC vs. Sandboxed Typed Gateway #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Trusts raw OS protocol activations blindly. An attacker can craft malicious Android intents or iOS custom scheme links to dynamically invoke arbitrary native plugins or execute unauthorized commands with unvalidated payloads. ```typescript import { onOpenUrl } from '@tauri-apps/plugin-deep-link'; import { invoke } from '@tauri-apps/api/core'; // VULNERABLE: Direct injection of OS intent data into native IPC commands export function setupDeepLinkListener(): void { onOpenUrl(async (urls: string[]) => { for (const rawUrl of urls) { const parsed = new URL(rawUrl); // Attacker controls params: app://execute?cmd=download&target=/system/priv const action = parsed.searchParams.get('action'); const payload = parsed.searchParams.get('payload'); if (action) { await invoke(`plugin:core|${action}`, { payload }); } } }); } ``` #### Production Standard (Correct) > **Standard**: Enforces strict origin validation (scheme and host), parses incoming URI parameters through an immutable Zod discriminated union schema, validates cryptographic state tokens, and invokes explicit, compile-time verified Tauri commands instead of dynamically interpolating intent targets. ```typescript import { onOpenUrl } from '@tauri-apps/plugin-deep-link'; import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const ALLOWED_SCHEME = 'myapp:'; const ALLOWED_HOST = 'app.internal'; const DeepLinkPayloadSchema = z.discriminatedUnion('intent', [ z.object({ intent: z.literal('auth_callback'), code: z.string().min(16).max(256), state: z.string().uuid() }), z.object({ intent: z.literal('view_resource'), resourceId: z.string().regex(/^[a-zA-Z0-9_-]{8,32}$/) }) ]); type ValidatedIntent = z.infer<typeof DeepLinkPayloadSchema>; function sanitizeAndParseUri(rawUrl: string): ValidatedIntent | null { try { const parsed = new URL(rawUrl); if (parsed.protocol !== ALLOWED_SCHEME || parsed.host !== ALLOWED_HOST) { console.error('Rejected unauthorized deep-link origin:', rawUrl); return null; } const rawParams = Object.fromEntries(parsed.searchParams.entries()); const validation = DeepLinkPayloadSchema.safeParse({ intent: parsed.pathname.replace(/^\//, ''), ...rawParams }); return validation.success ? validation.data : null; } catch { return null; } } export function setupDeepLinkListener(expectedStateToken: string): void { onOpenUrl(async (urls: string[]) => { for (const rawUrl of urls) { const intent = sanitizeAndParseUri(rawUrl); if (!intent) continue; switch (intent.intent) { case 'auth_callback': if (intent.state !== expectedStateToken) { console.error('State token mismatch: possible CSRF/hijack'); return; } await invoke('plugin:auth|complete_oauth_flow', { code: intent.code }); break; case 'view_resource': await invoke('plugin:navigation|navigate_to_resource', { id: intent.resourceId }); break; } } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary

Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary defines an industrial-grade behavioral standard for mobile engineering. Protects native core capabilities from malicious OS protocol handler injections by enforcing strict URI schema validation, origin allowlisting, and isolation boundaries before dispatching deep link payloads to privileged Tauri IPC commands. Unsanitized OS activations must never directly pass URI parameters into native plugins or arbitrary invoke handlers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind Pipeline Dispatch of Unsanitized OS Protocol URIs Directly into Privileged Native IPC Invokes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind Pipeline Dispatch of Unsanitized OS Protocol URIs Directly into Privileged Native IPC Invokes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate incoming deep link URIs against an explicit allowlist of authorized schemes, hosts, and structured pathnames before processing.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.