Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing

--- description: Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing - Enforce strict window-scoped capability mapping and granular command permissions in Tauri 2.0 to prevent privilege escalation via frontend DOM injection. All IPC commands must be explicitly registered within designated capability files restricted to specific window labels, remote domains, or webview instances. Wildcard permission grants or global command exposure across untrusted contexts violate the principle of least privilege and expose native OS operations to XSS exploitation. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-granular-ipc-sandboxing" --- # Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Global Unsandboxed IPC Commands and Over-Permissive Capability Scopes Exposing Native OS Execution ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Capability-Based Granular IPC Sandboxing. Mandate strict boundary isolation between webview frontend contexts and native Rust runtime entrypoints. Ensure zero use of default wildcard permissions, verify window-targeted capability mappings, enforce granular permission arguments, and reject any invoke calls that bridge untrusted remote contexts to unrestricted system APIs. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities into discrete JSON/TOML files within `src-tauri/capabilities/` targeting specific window labels via the `windows` array. - Engineers MUST NOT grant wildcard permissions (`core:default`, `fs:default`, `shell:all`) to windows loading dynamic remote URLs or non-isolated origins. - Rust commands MUST validate caller context and input parameters with typed serde deserialization, avoiding raw unvalidated string paths or shell tokens. - Capabilities MUST explicitly define granular `permissions` arrays containing fine-grained permission identifiers (e.g., `fs:allow-read-text-file` scoped to specific path patterns) rather than broad plugin-level presets. - Frontend bridge layers MUST invoke strongly typed wrappers using `@tauri-apps/api/core` invoke, disallowing runtime dynamic command reflection or arbitrary command string execution. ## Bad vs Good Implementations ### Tauri 2.0 Capability Sandboxing vs Wildcard Scope #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard window selectors ('*') with umbrella default permissions gives any webview, iframe, or injected script access to critical file system and shell execution primitives without boundary controls. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Anti-pattern: global wildcard capability granting full OS access to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions to the verified 'main' window label and limits the fs plugin to read-only access restricted precisely to the application's scoped data directory. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "isolated-app-capability", "description": "Production invariant: strictly scoped window capability with fine-grained permissions", "windows": ["main"], "permissions": [ "core:path:default", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/reports/**" }] }, "app:allow-generate-report" ] } ``` ### Rust Command Boundary Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Bypasses Tauri 2.0's managed capability layer by executing standard library file I/O directly on untrusted frontend-supplied paths, allowing directory traversal and sensitive data exfiltration. ```rust use tauri::command; // Anti-pattern: Unbounded command accepting arbitrary paths without capability checks #[command] pub fn read_user_file(path: String) -> Result<String, String> { std::fs::read_to_string(path).map_err(|e| e.to_string()) } fn main() { tauri::Builder::default() .invoke_handler(tauri::generate_handler![read_user_file]) .run(tauri::generate_context!()) .expect("error running app"); } ``` #### Production Standard (Correct) > **Standard**: Utilizes typed request DTOs, rigorously validates input formats, and delegates actual sensitive filesystem operations to Tauri's capability-sandboxed plugins. ```rust use tauri::{command, AppHandle, Runtime}; use std::path::PathBuf; #[derive(serde::Deserialize)] pub struct SafeReportRequest { pub report_id: String, } #[command] pub async fn generate_report<R: Runtime>( _app: AppHandle<R>, payload: SafeReportRequest, ) -> Result<PathBuf, String> { // Invariant: Enforce alphanumeric IDs; rely on Tauri capability ACLs for disk access if !payload.report_id.chars().all(|c| c.is_alphanumeric() || c == '-') { return Err("Invalid report ID format".into()); } Ok(PathBuf::from(format!("reports/{}.pdf", payload.report_id))) } fn main() { tauri::Builder::default() .invoke_handler(tauri::generate_handler![generate_report]) .run(tauri::generate_context!()) .expect("error running app"); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing

Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing defines an industrial-grade behavioral standard for security engineering. Enforce strict window-scoped capability mapping and granular command permissions in Tauri 2.0 to prevent privilege escalation via frontend DOM injection. All IPC commands must be explicitly registered within designated capability files restricted to specific window labels, remote domains, or webview instances. Wildcard permission grants or global command exposure across untrusted contexts violate the principle of least privilege and expose native OS operations to XSS exploitation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Unsandboxed IPC Commands and Over-Permissive Capability Scopes Exposing Native OS Execution Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Unsandboxed IPC Commands and Over-Permissive Capability Scopes Exposing Native OS Execution	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities into discrete JSON/TOML files within `src-tauri/capabilities/` targeting specific window labels via the `windows` array.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.