CVE-2023-34460 (JSON, published 2023-06-23T20:15Z)
Description: value: Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/tauri-apps/tauri
Files changed:
.changes/config.json
.changes/core-leading-dot.md
core/tauri-config-schema/schema.json
core/tauri-utils/src/config.rs
core/tauri/src/scope/fs.rs
tooling/cli/schema.json
Commit message: fix(core): fix `require_literal_leading_dot` flipped behavior (#7227)



Vulnerable code:
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",
    /// Defaults to `false` on Unix systems and `true` on Windows
      _ => false,
      #[cfg(windows)]
        require_literal_leading_dot: false,
        #[cfg(windows)]
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `false` on Unix systems and `true` on Windows",

Fixed code:
    "sec": "Security fixes",
---
'tauri': 'patch:sec'
---

Fix regression in `1.4` where the default behavior of the file system scope was changed to allow reading hidden files and directories by default.
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",
    /// Defaults to `true` on Unix systems and `false` on Windows
      #[cfg(windows)]
      _ => false,
        #[cfg(windows)]
        require_literal_leading_dot: false,
              "description": "Whether or not paths that contain components that start with a `.` will require that `.` appears literally in the pattern; `*`, `?`, `**`, or `[...]` will not match. This is useful because such files are conventionally considered hidden on Unix systems and it might be desirable to skip them when listing files.\n\nDefaults to `true` on Unix systems and `false` on Windows",