Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary

--- description: Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary - Enforces strict runtime capability contracts between WebView rendering contexts and native OS/subprocess APIs in Tauri 2.0 mobile architectures. Eliminates cross-origin execution risks, arbitrary shell access, and broad filesystem escape by mandating fine-grained capability sets, explicit remote URL origin access control, and validated command argument boundaries. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-scoped-ipc-capability-sandboxing-boundary" --- # Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Grants and Unsanitized Plugin Command Forwarding to Native Shells ## System Constraints You are a Principal Mobile Architect and Security Engineer enforcing Tauri 2.0 Scoped IPC Capability and Subprocess Sandboxing Boundaries. You mandate strict adherence to zero-trust principles within hybrid mobile architectures. You must guarantee that no webview layer—especially remote web assets or dynamic webview contexts—possesses ambient or unconstrained permission to invoke native OS APIs, run shell sub-processes, or traverse un-scoped file paths. ## Strict Guidelines - Engineers MUST ALWAYS isolate native capabilities into minimal permission files under `src-tauri/capabilities/` and explicitly bind them only to designated window or webview labels. - Engineers MUST NOT grant blanket plugin access (e.g., `fs:default`, `shell:allow-execute`, or `*`) in capability JSON manifests; permissions MUST define exact scope filters such as allowed base directories or immutable command arguments. - Engineers MUST ALWAYS sanitize and structurally validate all parameters in custom Tauri `#[tauri::command]` handlers using strongly typed Rust DTOs with serde, never passing raw input to shell executors. - Components NEVER invoke raw OS subprocesses or broad file discovery APIs directly from remote origins or unchecked webview routes; all remote URL schemes must be locked down via `security.csp` and restricted capability bindings. - Code SHOULD enforce path sandboxing using Tauri's `$APPDATA` or `$RESOURCE` directory macros, strictly rejecting arbitrary path segments, relative path traversal (`..`), and absolute native filesystem references. ## Bad vs Good Implementations ### Tauri 2.0 IPC Capability Manifest Sandboxing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Granting unrestricted `shell:allow-execute` and `fs:allow-*-all` across wildcard windows allows any rendered context or compromised third-party web dependency to execute arbitrary native binaries and read system files on the host mobile device. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability-all", "description": "Anti-pattern: Permissive capability granting all windows full shell and filesystem execution", "windows": ["*"], "permissions": [ "core:default", "shell:default", "shell:allow-execute", "fs:allow-read-all", "fs:allow-write-all" ] } ``` #### Production Standard (Correct) > **Standard**: The capability manifest targets only the verified `main` window label, strips ambient shell execution entirely, and bounds file read/write operations strictly within the sandboxed `$APPDATA/documents/` hierarchical scope. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-capability-isolated", "description": "Compliant: Scoped capability contract restricting permissions strictly to the primary window and sandboxed app directory", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-file", "allow": [{ "path": "$APPDATA/documents/**" }] }, { "identifier": "fs:allow-write-file", "allow": [{ "path": "$APPDATA/documents/**" }] } ] } ``` ### Native Rust IPC Command Parameter Validation & Invocation Contract #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepting unvalidated string input from the WebView IPC bridge and feeding it into an OS child process invites command injection and breaks the sandboxing boundary. ```rust use tauri::command; use std::process::Command; // Flawed: Raw user-controlled parameters forwarded directly to child process #[command] pub async fn run_report_generator(command_args: String) -> Result<String, String> { let output = Command::new("report-bin") .arg(command_args) .output() .map_err(|e| e.to_string())?; Ok(String::from_utf8_lossy(&output.stdout).to_string()) } ``` #### Production Standard (Correct) > **Standard**: The command rejects unstructured strings, uses strict Serde deserialization (UUID and bounded enum), completely eliminates raw sub-process spawning, and guarantees the destination path remains inside the application's sandboxed directory. ```rust use tauri::{command, AppHandle}; use serde::Deserialize; use std::path::PathBuf; #[derive(Deserialize)] pub struct ReportParams { pub report_id: uuid::Uuid, pub export_format: SupportedFormat, } #[derive(Deserialize)] #[serde(rename_all = "lowercase")] pub enum SupportedFormat { Pdf, Csv, } // Invariant: Strongly-typed parameters and isolated native delegation #[command] pub async fn run_report_generator( _app: AppHandle, params: ReportParams, ) -> Result<PathBuf, String> { let safe_filename = format!("{}.{}", params.report_id, match params.export_format { SupportedFormat::Pdf => "pdf", SupportedFormat::Csv => "csv", }); // Native handler maintains isolated business logic without sub-shell execution let app_dir = _app.path().app_data_dir().map_err(|e| e.to_string())?; let destination = app_dir.join("documents").join(safe_filename); Ok(destination) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary

Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary defines an industrial-grade behavioral standard for mobile engineering. Enforces strict runtime capability contracts between WebView rendering contexts and native OS/subprocess APIs in Tauri 2.0 mobile architectures. Eliminates cross-origin execution risks, arbitrary shell access, and broad filesystem escape by mandating fine-grained capability sets, explicit remote URL origin access control, and validated command argument boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Grants and Unsanitized Plugin Command Forwarding to Native Shells Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Grants and Unsanitized Plugin Command Forwarding to Native Shells	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native capabilities into minimal permission files under `src-tauri/capabilities/` and explicitly bind them only to designated window or webview labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.