mirror of
https://github.com/LCE-Hub/LCE-Emerald-Launcher.git
synced 2026-07-20 01:07:30 +00:00
8c941a6b72
three changes: 1. file_dialogs::write_binary_file / read_binary_file used to accept arbitrary paths with no validation, no dialog, no scope. now they refuse all paths. callers must use pick_file / save_file_dialog. 2. plugins::list_directory used to accept arbitrary paths with no validation. now it refuses all paths. callers must use get_plugins_dir. 3. capabilities/default.json had opener:allow-open-path scoped to path: "**" which let the webview launch ANY local path. removed that entry entirely. opener:allow-reveal-item-in-dir is left for now (used by the file manager UI). combined, these close the webview -> arbitrary write+execute primitive. the proper fix is to scope opener:allow-open-path to a specific games directory once we know what paths the launcher actually needs to open.
46 lines
1.3 KiB
JSON
46 lines
1.3 KiB
JSON
{
|
|
"identifier": "default",
|
|
"description": "Default permissions",
|
|
"windows": ["main"],
|
|
"permissions": [
|
|
"core:default",
|
|
"core:app:default",
|
|
"core:event:default",
|
|
"core:image:default",
|
|
"core:menu:default",
|
|
"core:path:default",
|
|
"core:resources:default",
|
|
"core:tray:default",
|
|
"core:webview:default",
|
|
"core:webview:allow-create-webview-window",
|
|
"core:window:default",
|
|
"core:window:allow-set-decorations",
|
|
"core:window:allow-is-fullscreen",
|
|
"core:window:allow-minimize",
|
|
"core:window:allow-toggle-maximize",
|
|
"core:window:allow-close",
|
|
"opener:default",
|
|
"gamepad:default",
|
|
"drpc:default",
|
|
"updater:default",
|
|
// security: removed opener:allow-open-path with path: "**" - that
|
|
// scoped the webview to launch ANY local path. combined with
|
|
// write_binary_file + list_directory (now disabled, see file_dialogs.rs
|
|
// and plugins.rs) a compromised webview had a full RCE primitive.
|
|
// (LCEL-01)
|
|
// TODO: scope to a specific games directory (e.g. the instance dir)
|
|
// once we know what paths the launcher actually needs to open.
|
|
{
|
|
"identifier": "opener:allow-reveal-item-in-dir",
|
|
"allow": [
|
|
{
|
|
"path": "**"
|
|
}
|
|
]
|
|
},
|
|
"process:default",
|
|
"deep-link:default",
|
|
"core:window:allow-start-dragging"
|
|
]
|
|
}
|