dnrops
/
tauri
mirror of https://github.com/tauri-apps/tauri
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

feat(core): validate `AppImage` execution when env vars are set [TRI-041] (#17)

This commit is contained in:
Lucas Fernandes Nogueira 2021-10-24 09:24:18 -03:00 committed by Lucas Nogueira
parent 8259cd64c2
commit 6fbd6dba52
No known key found for this signature in database
GPG Key ID: 2714B66BCFB01F7F
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changes/validate-appimage.md Normal file
View File

@ -0,0 +1,5 @@
---
"tauri": patch
---
Validate the `std::env::current_exe` return value if `APPDIR` or `APPIMAGE` environment variables are set.

15
core/tauri-utils/src/lib.rs
View File

@ -39,6 +39,7 @@ impl PackageInfo {
/// Information about environment variables. /// Information about environment variables.
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
#[non_exhaustive]
pub struct Env { pub struct Env {
/// The APPIMAGE environment variable. /// The APPIMAGE environment variable.
#[cfg(target_os = "linux")] #[cfg(target_os = "linux")]
@ -51,12 +52,24 @@ pub struct Env {
#[allow(clippy::derivable_impls)] #[allow(clippy::derivable_impls)]
impl Default for Env { impl Default for Env {
fn default() -> Self { fn default() -> Self {
Self { let env = Self {
#[cfg(target_os = "linux")] #[cfg(target_os = "linux")]
appimage: std::env::var_os("APPIMAGE"), appimage: std::env::var_os("APPIMAGE"),
#[cfg(target_os = "linux")] #[cfg(target_os = "linux")]
appdir: std::env::var_os("APPDIR"), appdir: std::env::var_os("APPDIR"),
};
if env.appimage.is_some() || env.appdir.is_some() {
// validate that we're actually running on an AppImage
// an AppImage is mounted to `/tmp/.mount_${appPrefix}${hash}`
// see https://github.com/AppImage/AppImageKit/blob/1681fd84dbe09c7d9b22e13cdb16ea601aa0ec47/src/runtime.c#L501
if !std::env::current_exe()
.map(|p| p.to_string_lossy().into_owned().starts_with("/tmp/.mount_"))
.unwrap_or(true)
{
panic!("`APPDIR` or `APPIMAGE` environment variable found but this application was not detected as an AppImage; this might be a security issue.");
}
} }
env
} }
} }