Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation

--- description: Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation - Enforces granular capability Access Control Lists (ACLs), path-scoped permissions, and strict WebView origin isolation in Tauri 2.0 mobile architectures. Eliminates arbitrary native binary execution, unauthorized file system access, and command injection arising from compromised frontend dependencies or untrusted WebViews. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-scoped-ipc-capability-acl-origin-isolation" --- # Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Permissive IPC Wildcarding, Default Global Capabilities, and Unscoped Native Invocation ## System Constraints You are a Principal Security Architect specializing in Tauri 2.0 mobile runtimes (iOS and Android). Enforce strict zero-trust boundaries between the frontend WebView and the native Rust layer. Reject any capability configuration using wildcard permissions, unconstrained file/shell scopes, or unbound window contexts. Mandate strict schema-validated IPC wrappers and explicit origin binding for all native command invocations. ## Strict Guidelines - Engineers MUST NEVER use wildcards ('*') or blanket permissions such as 'core:default' combined with unrestricted 'shell:*' or 'fs:*' in Tauri 2.0 capability JSON files. - Engineers MUST declare separate, granular capability JSON files under 'src-tauri/capabilities/' partitioned strictly by window label (e.g., 'main-window.json', 'auth-window.json'). - Engineers MUST restrict all file-system and shell permissions with precise 'allow' scopes, anchoring paths strictly to '$APPDATA' or '$CACHE' directories and banning root ('/' or 'C:\') access. - Engineers MUST validate the caller origin in Rust commands handling sensitive operations using the 'tauri::ipc::Request' or 'tauri::Webview' handle to confirm execution from internal asset protocols. - Engineers MUST NOT invoke Tauri native commands using dynamically computed string identifiers in frontend code; all IPC commands MUST route through type-safe, compile-time verified wrappers. - Frontend components NEVER execute raw shell commands directly; native invocations MUST be abstracted behind domain-specific Rust commands with strict input parameter validation. - Services MUST configure 'app.security.csp' within 'tauri.conf.json' to forbid unsafe-eval, external script injection, and arbitrary WebSocket connections on mobile WebViews. ## Bad vs Good Implementations ### Granular Scoped Capability Definition vs. Unrestricted Global ACL #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Assigns full shell execution and unconstrained filesystem permissions to all windows (*). A compromised npm dependency or XSS vulnerability can execute arbitrary binaries on the host device or mobile sandbox. ```typescript // src-tauri/capabilities/default.json (Anti-pattern: global wildcard privileges) /* { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default", "description": "Enables everything for all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default", "shell:allow-execute" ] } */ import { invoke } from '@tauri-apps/api/core'; // Frontend: Executing arbitrary system command with direct string invoke export async function executeUserScript(cmd: string, args: string[]): Promise<string> { return await invoke<string>('plugin:shell|execute', { program: cmd, args: args }); } ``` #### Production Standard (Correct) > **Standard**: Restricts capabilities to the specific 'main' window label, defines precise directory path scopes under $APPDATA, eliminates the shell plugin entirely, and wraps the invocation in a schema-validated domain function. ```typescript // src-tauri/capabilities/mobile-runtime.json (Scoped capability invariant) /* { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-runtime", "description": "Minimal capability set restricted to the main mobile view", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-file", "allow": [{ "path": "$APPDATA/secure_vault/*" }] } ] } */ import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const SafeFileReadPayloadSchema = z.object({ fileName: z.string().regex(/^[a-zA-Z0-9_-]+\.bin$/) }); type SafeFileReadPayload = z.infer<typeof SafeFileReadPayloadSchema>; // Frontend: Strictly typed, validated domain IPC wrapper export async function readSecureVaultFile(payload: SafeFileReadPayload): Promise<Uint8Array> { const validated = SafeFileReadPayloadSchema.parse(payload); const response = await invoke<number[]>('read_vault_record', { fileName: validated.fileName }); return new Uint8Array(response); } ``` ### Rust IPC Command Origin and Path Traversal Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The Rust command blindly trusts input paths, enabling directory traversal vulnerabilities across the mobile sandbox, and does not verify the requesting window or origin. ```typescript // src-tauri/src/main.rs (Anti-pattern: Rust command with zero origin or path checks) /* #[tauri::command] pub fn read_vault_record(file_name: String) -> Result<Vec<u8>, String> { let path = std::path::Path::new("/var/data/").join(file_name); std::fs::read(path).map_err(|e| e.to_string()) } */ // Calling from frontend without sanitization import { invoke } from '@tauri-apps/api/core'; export async function fetchFile(untrustedInput: string) { return await invoke('read_vault_record', { fileName: '../../etc/passwd' }); } ``` #### Production Standard (Correct) > **Standard**: Validates that the calling webview matches the expected label, canonicalizes paths to eliminate path traversal, and enforces containment inside the app's secure directory. ```typescript // src-tauri/src/main.rs (Production invariant: Canonicalized path and window origin check) /* use std::path::{Component, PathBuf}; tauri::command pub async fn read_vault_record( webview: tauri::Webview, file_name: String, ) -> Result<Vec<u8>, String> { if webview.label() != "main" { return Err("Unauthorized caller window".into()); } let path = PathBuf::from(&file_name); if path.components().any(|c| matches!(c, Component::ParentDir | Component::RootDir)) { return Err("Path traversal detected".into()); } let base_dir = webview.app_handle().path().app_data_dir() .map_err(|e| e.to_string())? .join("secure_vault"); let full_path = base_dir.join(path); let canonical_base = std::fs::canonicalize(&base_dir).map_err(|e| e.to_string())?; let canonical_target = std::fs::canonicalize(&full_path).map_err(|e| e.to_string())?; if !canonical_target.starts_with(canonical_base) { return Err("Scope boundary violation".into()); } std::fs::read(canonical_target).map_err(|e| e.to_string()) } */ import { invoke } from '@tauri-apps/api/core'; export async function readVaultRecord(sanitizedFileName: string): Promise<Uint8Array> { const bytes = await invoke<number[]>('read_vault_record', { fileName: sanitizedFileName }); return new Uint8Array(bytes); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation

Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces granular capability Access Control Lists (ACLs), path-scoped permissions, and strict WebView origin isolation in Tauri 2.0 mobile architectures. Eliminates arbitrary native binary execution, unauthorized file system access, and command injection arising from compromised frontend dependencies or untrusted WebViews. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permissive IPC Wildcarding, Default Global Capabilities, and Unscoped Native Invocation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permissive IPC Wildcarding, Default Global Capabilities, and Unscoped Native Invocation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER use wildcards ('*') or blanket permissions such as 'core

Engineers MUST NEVER use wildcards ('*') or blanket permissions such as 'core:default' combined with unrestricted 'shell:*' or 'fs:*' in Tauri 2.0 capability JSON files.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.