Improper Default FS Permission Hardening

Impact

The Tauri fs plugin (from the plugin-workspace repository) shipped with default permissions intended to prevent access to local WebView folders. However, this hardening failed to apply when developers explicitly granted access to the $APPLOCALDATA folder and its subfolders.

This issue only impacts applications where the frontend is explicitly allowed to read from or write to the $APPLOCALDATA folder and its subfolders. A successful exploit requires an existing primitive that allows execution of fs plugin commands with arbitrary parameters, or arbitrary Cross-Site Scripting (XSS) within the context of the Tauri application’s WebView window.

Patches

This issue has been resolved in the latest release of the fs plugin.

• On Windows: Access to the WebView data folder ($APPLOCALDATA/EBWebView) is now correctly denied.
• On Linux: Access to WebView data paths inside $APPLOCALDATA is now correctly denied.

Workarounds

Since this issue affects only the frontend, you can manually apply the fixed permissions to existing applications. However, we recommend upgrading to the latest version of the plugin.

References

#3507