CVE-2023-34460: Improper Authorization (CWE-285)
value: Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.


CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.8
Published: 2023-06-23T20:15Z
Repository: https://github.com/tauri-apps/tauri
Language: JSON
Files changed: .changes/config.json, .changes/core-leading-dot.md, core/tauri-config-schema/schema.json, core/tauri-utils/src/config.rs, core/tauri/src/scope/fs.rs, tooling/cli/schema.json
Commit date: 2023-06-17 09:17:36 -0300
Commit message: fix(core): fix `require_literal_leading_dot` flipped behavior (#7227)


Diff: diff --git a/.changes/config.json b/.changes/config.json
index 7d7bbe20e..78a03db4c 100644
--- a/.changes/config.json
+++ b/.changes/config.json
@@ -5,10 +5,11 @@
     "feat": "New Features",
     "enhance": "Enhancements",
     "bug": "Bug Fixes",
     "pref": "Performance Improvements",
     "changes": "What's Changed",
+    "sec": "Security fixes",
     "deps": "Dependencies"
   },
   "defaultChangeTag": "changes",
   "pkgManagers": {
     "rust": {
diff --git a/.changes/core-leading-dot.md b/.changes/core-leading-dot.md
new file mode 100644
index 000000000..432d94ac6
--- /dev/null
+++ b/.changes/core-leading-dot.md
@@ -0,0 +1,5 @@
+---
+'tauri': 'patch:sec'
+---
+
+Fix regression in `1.4` where the default behavior of the file system scope was changed to allow reading hidden files and directories by default.
diff --git a/core/tauri-config-schema/schema.json b/core/tauri-config-schema/schema.json
index 4cf848842..9eff6b9bf 100644
--- a/core/tauri-config-schema/schema.json
+++ b/core/tauri-config-schema/schema.json
@@ -2100,11 +2100,11 @@
               "items": {
                 "type": "string"
               }
             },
             "requireLiteralLeadingDot": {
-              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",
+              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",
               "type": [
                 "boolean",
                 "null"
               ]
             }
diff --git a/core/tauri-utils/src/config.rs b/core/tauri-utils/src/config.rs
index afff520a8..6dbe8f727 100644
--- a/core/tauri-utils/src/config.rs
+++ b/core/tauri-utils/src/config.rs
@@ -1327,11 +1327,11 @@ pub enum FsAllowlistScope {
     /// will require that `.` appears literally in the pattern; `*`, `?`, `**`,
     /// or `[...]` will not match. This is useful because such files are
     /// conventionally considered hidden on Unix systems and it might be
     /// desirable to skip them when listing files.
     ///
-    /// Defaults to `false` on Unix systems and `true` on Windows
+    /// Defaults to `true` on Unix systems and `false` on Windows
     // dotfiles are not supposed to be exposed by default on unix
     #[serde(alias = "require-literal-leading-dot")]
     require_literal_leading_dot: Option<bool>,
   },
 }
diff --git a/core/tauri/src/scope/fs.rs b/core/tauri/src/scope/fs.rs
index 1deccf4cc..52bf2d23e 100644
--- a/core/tauri/src/scope/fs.rs
+++ b/core/tauri/src/scope/fs.rs
@@ -112,13 +112,13 @@ impl Scope {
         require_literal_leading_dot: Some(require),
         ..
       } => *require,
       // dotfiles are not supposed to be exposed by default on unix
       #[cfg(unix)]
-      _ => false,
-      #[cfg(windows)]
       _ => true,
+      #[cfg(windows)]
+      _ => false,
     };
 
     Ok(Self {
       allowed_patterns: Arc::new(Mutex::new(allowed_patterns)),
       forbidden_patterns: Arc::new(Mutex::new(forbidden_patterns)),
@@ -285,13 +285,13 @@ mod tests {
         // this is needed so `/dir/*` doesn't match files within subdirectories such as `/dir/subdir/file.txt`
         // see: https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5
         require_literal_separator: true,
         // dotfiles are not supposed to be exposed by default on unix
         #[cfg(unix)]
-        require_literal_leading_dot: false,
-        #[cfg(windows)]
         require_literal_leading_dot: true,
+        #[cfg(windows)]
+        require_literal_leading_dot: false,
         ..Default::default()
       },
     }
   }
 
diff --git a/tooling/cli/schema.json b/tooling/cli/schema.json
index 4cf848842..9eff6b9bf 100644
--- a/tooling/cli/schema.json
+++ b/tooling/cli/schema.json
@@ -2100,11 +2100,11 @@
               "items": {
                 "type": "string"
               }
             },
             "requireLiteralLeadingDot": {
-              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",
+              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",
               "type": [
                 "boolean",
                 "null"
               ]
             }

Vulnerable code:               "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",
    /// Defaults to `false` on Unix systems and `true` on Windows
      _ => false,
      #[cfg(windows)]
        require_literal_leading_dot: false,
        #[cfg(windows)]
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",
Fixed code:     "sec": "Security fixes",
---
'tauri': 'patch:sec'
---

Fix regression in `1.4` where the default behavior of the file system scope was changed to allow reading hidden files and directories by default.
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",
    /// Defaults to `true` on Unix systems and `false` on Windows
      #[cfg(windows)]
      _ => false,
        #[cfg(windows)]
        require_literal_leading_dot: false,
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",