dtourolle
38dd1129e5
`app.security.csp` was `null`, so the webview ran with no Content-Security-Policy
at all: any script that reached the web layer would have inherited the whole IPC
surface. There is no known injection path today (one app-owned `{@html}`, no
`innerHTML`/`eval`), so this is defence in depth rather than a fix for an open
hole.
`script-src 'self'` is the restrictive half — Tauri nonces SvelteKit's inline
bootstrap script at build time, so no `'unsafe-inline'` is needed — together with
`object-src`/`frame-src 'none'` and `base-uri 'self'`. `img-src`/`media-src`/
`connect-src` cannot be restrictive: the Jellyfin origin is typed in by the user
at run time and is routinely plain http on a LAN, so they allow `http:`/`https:`.
That is a wide grant for data, but it still bars `file:`/`filesystem:` and does
not touch script execution. A run-time policy naming the server exactly was
rejected: Tauri derives the header from immutable config when it serves the HTML,
so it would mean rebuilding config and reloading the webview on every server
change. `style-src` keeps `'unsafe-inline'` because Svelte compiles `style="…"`
attributes into markup; `worker-src`/`media-src` keep `blob:` for hls.js's
demuxer worker and its MSE object URL; `ipc:`/`http://ipc.localhost` keeps
`invoke` working. `devCsp` mirrors it with the eval/inline/websocket allowances
Vite's dev server needs.
The asset-protocol scope narrows from `$APPDATA/**` — the storage root holding
the SQLite database and the encrypted-token fallback file — to
`$APPDATA/thumbnails/**`. Since DR-137 moved downloaded media to the loopback
media server, `imageCache` is the only `convertFileSrc` caller left.
Needs manual verification on both platforms: thumbnails, online HLS video and
offline downloaded video cannot be exercised headlessly.
83 lines
2.8 KiB
TOML
83 lines
2.8 KiB
TOML
[package]
|
|
name = "jellytau"
|
|
version = "0.7.0"
|
|
description = "A Tauri App"
|
|
authors = ["you"]
|
|
edition = "2021"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[lib]
|
|
# The `_lib` suffix may seem redundant but it is necessary
|
|
# to make the lib name unique and wouldn't conflict with the bin name.
|
|
# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
|
|
name = "jellytau_lib"
|
|
crate-type = ["staticlib", "cdylib", "rlib"]
|
|
|
|
# Keep debug info minimal to reduce target/ size in CI (line numbers in
|
|
# backtraces are preserved; the bulky full debuginfo is dropped).
|
|
[profile.dev]
|
|
debug = "line-tables-only"
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
|
|
[dependencies]
|
|
# protocol-asset serves cached thumbnails to the webview (asset://localhost on
|
|
# Linux/macOS, http://asset.localhost on Windows/Android); without it
|
|
# convertFileSrc yields a URL nothing answers. Paired with
|
|
# app.security.assetProtocol in tauri.conf.json, which scopes it to
|
|
# $APPDATA/thumbnails/** — the one directory still read through this protocol.
|
|
# Downloaded media went the same way until DR-137 moved it to the loopback media
|
|
# server, so the database, the encrypted-token fallback file and downloads/ are
|
|
# all outside the grant now.
|
|
# TRACES: UR-012, UR-071 | DR-134, DR-137, DR-198
|
|
tauri = { version = "2", features = ["protocol-asset"] }
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-os = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
rand = "0.8"
|
|
tokio = { version = "1", features = ["sync", "rt-multi-thread", "time", "fs", "io-util", "macros"] }
|
|
tokio-util = "0.7"
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
|
|
urlencoding = "2"
|
|
futures-util = "0.3"
|
|
async-trait = "0.1"
|
|
|
|
# SQLite for offline storage
|
|
tokio-rusqlite = "0.6"
|
|
rusqlite = { version = "0.32", features = ["bundled"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
directories = "5"
|
|
|
|
# Secure credential storage (system keyring with encrypted file fallback)
|
|
keyring = "3"
|
|
aes-gcm = "0.10"
|
|
base64 = "0.22"
|
|
sha2 = "0.10"
|
|
getrandom = "0.2"
|
|
log = "0.4"
|
|
env_logger = "0.11"
|
|
tauri-specta = { version = "=2.0.0-rc.21", features = ["derive", "typescript"] }
|
|
specta-typescript = "=0.0.9"
|
|
specta = { version = "=2.0.0-rc.22", features = ["chrono", "derive"] }
|
|
tiny_http = { version = "0.12.0", default-features = false }
|
|
|
|
# Linux-specific dependencies
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
hostname = "0.4"
|
|
libc = "0.2"
|
|
# Use latest git version for better MPV version compatibility
|
|
libmpv = { git = "https://github.com/ParadoxSpiral/libmpv-rs.git", branch = "master" }
|
|
|
|
# JNI for Android ExoPlayer integration
|
|
[target.'cfg(target_os = "android")'.dependencies]
|
|
jni = "0.21"
|
|
ndk-context = "0.1"
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3.24.0"
|
|
|