Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail

--- description: Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail - Enforces strict principle of least privilege across Tauri 2.0 mobile webviews by mandating granular capability definitions, explicit command permission scopes, and defensive argument schema validation. Prevents complete host device compromise and privilege escalation resulting from cross-site scripting (XSS) or untrusted content injections within Android and iOS webviews. globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-ipc-acl-capability-isolation" --- # Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Over-permissive wildcard capabilities with unconstrained custom IPC command execution in mobile webview environments ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 IPC Capability Isolation and Granular Access Control on mobile platforms. Your mandate is to prevent privilege escalation from webview environments to native mobile runtimes (Android/iOS). Reject all wildcard permissions ('*', 'allow-all'), unvalidated raw filesystem access, and unconstrained native invocations. Mandate strict platform-scoped capability JSON manifests, rigorous argument validation using strongly typed Rust structs, and typed frontend IPC boundaries. ## Strict Guidelines - Engineers MUST NEVER configure generic wildcard capability sets (e.g., 'core:default', 'fs:allow-all', or '*' permissions) in production mobile capability manifests. - Engineers MUST declare fine-grained capabilities inside 'src-tauri/capabilities/' partitioned strictly by window/webview label and target platform ('android' | 'ios'). - Custom native commands exposed via #[tauri::command] MUST implement defensive argument validation, rejecting path traversals, relative references, and unvalidated URI schemes. - Code SHOULD sanitize all parameters on both the TypeScript client layer using Zod/ArkType and the Rust command layer using typed serde deserializers with validation constraints. - Services MUST NEVER invoke low-level shell execution or arbitrary file writes from mobile webviews without cryptographic verification and isolated sandboxing. - Components NEVER invoke raw 'invoke("...")' calls directly within UI templates; invocations MUST be encapsulated within strongly-typed, runtime-validated IPC client wrappers. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Definition #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants unrestricted filesystem and core capabilities to all windows across all platforms. If an XSS vulnerability occurs in the webview, an attacker can access the entire sandboxed mobile file system and invoke arbitrary core commands. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Capability for mobile webview", "windows": ["*"], "permissions": [ "core:default", "fs:default", "fs:allow-read-all", "fs:allow-write-all" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions to the 'main' window on target mobile platforms, restricts filesystem read access strictly to the application's secure-cache directory, and prohibits arbitrary native plugin invocations. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Least-privilege capability for authenticated mobile app shell", "windows": ["main"], "platforms": ["android", "ios"], "permissions": [ "core:app:allow-version", "core:event:allow-listen", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/secure-cache/*" } ] }, "secure-store:allow-read-credential" ] } ``` ### Rust IPC Command Input Validation and Defensive Path Boundary #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Blindly joins untrusted string parameters into a path buffer without traversal checks or validation, allowing webview exploits to break out of intended directories. ```rust #[tauri::command] pub async fn read_user_report(file_name: String) -> Result<String, String> { // Vulnerable to path traversal: ../../../etc/passwd or Android shared prefs let path = std::path::PathBuf::from("/data/user/0/com.app/files").join(file_name); std::fs::read_to_string(path).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Validates the input characters to prevent directory traversal, computes canonical paths, and asserts strict prefix containment within the designated application reports folder before reading. ```rust use std::path::{Component, PathBuf}; use tauri::Manager; #[derive(serde::Deserialize)] pub struct ReportQuery { pub report_id: String, } #[tauri::command] pub async fn read_user_report( app: tauri::AppHandle, payload: ReportQuery, ) -> Result<String, String> { // Validate that payload contains only alphanumeric characters (no traversal sequences) if !payload.report_id.chars().all(|c| c.is_ascii_alphanumeric() || c == '-') { return Err("Invalid report ID format: traversal characters forbidden".into()); } let app_dir = app.path().app_data_dir().map_err(|e| e.to_string())?; let safe_target = app_dir.join("reports").join(format!("{}.json", payload.report_id)); // Verify canonical path containment let canonical = safe_target.canonicalize().map_err(|_| "Report not found".to_string())?; let canonical_base = app_dir.join("reports").canonicalize().map_err(|_| "Storage error".to_string())?; if !canonical.starts_with(&canonical_base) { return Err("Access violation: path outside report scope".into()); } tokio::fs::read_to_string(canonical).await.map_err(|e| e.to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail

Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict principle of least privilege across Tauri 2.0 mobile webviews by mandating granular capability definitions, explicit command permission scopes, and defensive argument schema validation. Prevents complete host device compromise and privilege escalation resulting from cross-site scripting (XSS) or untrusted content injections within Android and iOS webviews. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Over-permissive wildcard capabilities with unconstrained custom IPC command execution in mobile webview environments Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Over-permissive wildcard capabilities with unconstrained custom IPC command execution in mobile webview environments	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER configure generic wildcard capability sets (e.g., 'core

Engineers MUST NEVER configure generic wildcard capability sets (e.g., 'core:default', 'fs:allow-all', or '*' permissions) in production mobile capability manifests.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.