Skip to content

fix(Tauri): fix capabilities and asset protocol configs #1292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
UNIkeEN merged 2 commits into from
Jan 8, 2026
+10 −3
Merged

fix(Tauri): fix capabilities and asset protocol configs #1292

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
851e4ae
fix(Tauri): fix capabilities and asset protocol configs
UNIkeEN Jan 8, 2026
3aaa45c
support 2-depth
UNIkeEN Jan 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions src-tauri/capabilities/desktop.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,16 @@
"path": "**"
},
{
"path": "**/.minecraft"
"path": "**/.*"
},
{
"path": "**/.minecraft/**"
"path": "**/.*/**"
},
{
"path": "**/.*/**/.*"
},
{
"path": "**/.*/**/.*/**"
Comment on lines +28 to +33
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pattern **/.*/**/.* appears to be attempting to match hidden files within hidden directories, but this pattern may not work as intended. In glob patterns, **/ matches zero or more directories, so **/.*/**/.* could match paths like dir/.hidden/file but the meaning is unclear.

If the intention is to match nested hidden directories like .minecraft/.hidden_subdir, consider clarifying the requirement and testing whether this pattern actually achieves it. The pattern might need to be **/.*/.*/, or multiple specific patterns may be needed depending on the actual directory structures being accessed.

Suggested change
},
{
"path": "**/.*/**/.*"
},
{
"path": "**/.*/**/.*/**"

Copilot uses AI. Check for mistakes.
}
Comment on lines +24 to 34
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The opener plugin paths have been changed from specifically allowing .minecraft directories to broadly allowing ALL hidden directories and files. This significantly widens the security scope beyond what appears necessary.

The patterns **/.*, **/.*/**, **/.*/**/.*, and **/.*/**/.*/** will match any hidden file or directory (starting with a dot) at any filesystem level. This allows the application to open files from sensitive directories like ~/.ssh, ~/.aws, ~/.gnupg, etc.

Consider using more specific patterns that only match the required paths. If the issue is that .minecraft needs to be accessed at different filesystem levels, use **/.minecraft and **/.minecraft/** instead. If other specific hidden directories are needed for the opener functionality, list them explicitly rather than using broad wildcard patterns.

Copilot uses AI. Check for mistakes.
]
},
Expand Down
3 changes: 2 additions & 1 deletion src-tauri/tauri.conf.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,8 @@
"enable": true,
"scope": [
"**",
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The asset protocol scope in tauri.conf.json is missing the **/.* pattern that is present in the opener permissions in desktop.json. This inconsistency means that while files can be opened from paths matching **/.* (hidden files/directories at any level), they cannot be served via the asset protocol.

For consistency between the two configuration files, either add the **/.* pattern here, or remove it from desktop.json if it's not actually needed. Consider whether direct access to hidden files (not just their contents) is required by the asset protocol.

Suggested change
"**",
"**",
"**/.*",

Copilot uses AI. Check for mistakes.
"**/.minecraft/**"
"**/.*/**",
"**/.*/**/.*/**"
Comment on lines +56 to +57
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The asset protocol scope has been changed from specifically allowing .minecraft directories to broadly allowing ALL hidden directories and files across the filesystem. This significantly widens the security scope beyond what appears necessary.

The patterns **/.*/** and **/.*/**/.*/** will match any hidden directory (starting with a dot) at any filesystem level. This means the application can now serve assets from sensitive directories like ~/.ssh, ~/.aws, ~/.config, etc.

Consider using more specific patterns that only match the required paths. If the issue is that .minecraft needs to be accessed at different filesystem levels, use **/.minecraft/** instead. If other specific hidden directories are needed, list them explicitly rather than using a broad wildcard pattern.

Suggested change
"**/.*/**",
"**/.*/**/.*/**"
"**/.minecraft/**"

Copilot uses AI. Check for mistakes.
]
}
}
Expand Down
Loading