News for hackers. Stuff that matters.

A comment on Tauri – toolchain for building secure native apps that have tiny binaries. Parent comment

Re:Tauri – toolchain for building secure native apps that ha... by zemnmez on Wednesday July 08, 2020 @03:15PM (#23773257)
The author(s) got in contact with me about this post: it does appear that the APIs are exposed at the window level, meaning any iframe can access these functions. It's important to note that CSP does not traverse iframes, or at least, has very strict rules about how it does due to an information leak in CSP1 [1]. This means embedded content is not going to be affected by any CSP rules. OEMBED content, or sandboxed rendered markdown is going to be served from the `null` origin, meaning that frame-src rules will have no granularity.

[1]: http://archive.is/UXD8j

[ Parent | on HN ]
Re:Tauri – toolchain for building secure native apps that ha... by buffersandbeer on Wednesday July 08, 2020 @07:56PM (#23775592)
Has an issue been opened in their github for this? I looked quickly and didn't see one, but would love to track it.
[ Parent | on HN ]
Re:Tauri – toolchain for building secure native apps that ha... by nim2020 on Sunday July 12, 2020 @07:26AM (#23810564)
I just filed one: https://github.com/tauri-apps/tauri/issues/814
[ Parent | on HN ]
Re:Tauri – toolchain for building secure native apps that ha... by zemnmez on Wednesday July 08, 2020 @10:27PM (#23776403)
i havent seen / made one
[ Parent | on HN ]