DOCSEARCHbyAlgolia
Submit Docs

Tauri Plugins Workspace

repository·v2·Indexed 23 days ago

https://github.com/tauri-apps/plugins-workspace

A workspace of official Tauri plugins that extend application capabilities by providing access to native system features. Included plugins cover functionalities such as autostart, barcode scanning, biometric authentication, CLI argument parsing, clipboard management, and system updates.

Tokens
122.3K
Snippets
344
Records
724
Agent score
83%

What's inside tauri-apps-plugins-workspace

  1. Overview of available Tauri Plugins and platform support

    v2

    The plugins-workspace contains a variety of official Tauri plugins. Use the following table to determine which plugin meets your needs and which platforms (Windows, macOS, Linux, iOS, Android) it supports.

    PluginDescriptionWinMacLiniOSAnd
    autostartAutomatically launch your app at system startup.✅✅✅❌❌
    barcode-scannerScan QR codes, EAN-13, and other barcodes via camera.???✅✅
    biometricPrompt for biometric authentication.???✅✅
    cliParse command line interface arguments.✅✅✅❌❌
    clipboard-managerRead and write to the system clipboard.✅✅✅✅✅
    deep-linkSet app as the default handler for a URL.✅✅✅✅✅
    dialogNative system dialogs (open/save/message).✅✅✅✅✅
    fsAccess the file system.✅✅✅??
    geolocationGet and track current device position.???✅✅
    global-shortcutRegister global keyboard shortcuts.✅✅✅??
    hapticsHaptic feedback and vibrations.???✅✅
    httpAccess a Rust-based HTTP client.✅✅✅✅✅
    localhostUse a localhost server in production apps.✅✅✅??
    logConfigurable logging.✅✅✅✅✅
    nfcRead and write NFC tags.???✅✅
    notificationSend OS message notifications.✅✅✅✅✅
    openerOpen files/URLs with default applications.✅✅✅✅✅
    osRead operating system information.✅✅✅✅✅
    persisted-scopePersist runtime filesystem scope changes.✅✅✅??
    positionerMove windows to common locations.✅✅✅❌❌
    processAccess current process info.✅✅✅??
    shellAccess system shell and spawn child processes.✅✅✅??
    single-instanceEnsure only one instance of the app is running.✅✅✅❌❌
    sqlInterface with SQL databases.✅✅✅✅✅
    storePersistent key-value storage.✅✅✅✅✅
    strongholdEncrypted, secure database.✅✅✅??
    updaterIn-app updates.✅✅✅❌❌
    uploadFile uploads through HTTP.✅✅✅✅✅
    websocketWebSocket connection via Rust client.✅✅✅??
    window-statePersist window sizes and positions.✅✅✅❌❌

    Legend:

    • ✅: (Partially) Supported
    • ❌: Not supported
    • ? : Unknown/Untested or Planned

  3. Understand default permissions for the fs plugin

    v2

    By default, the fs plugin is configured with a restricted permission set that allows access only to application-specific directories. This prevents the application from accessing critical system components or other user data without explicit permission.

    Granted Permissions

    The default set enables read and write access to the following application-specific directories and their contents:

    • AppConfig
    • AppData
    • AppLocalData
    • AppCache
    • AppLog

    Note that these directories must typically be manually created by your application at runtime before they can be used. The mkdir command is permitted for creating these folders.

    Denied Permissions

    Access to critical Tauri application components is denied by default. For example, on Windows, access to the webview data folder is explicitly denied.

  4. Security model and threat considerations for tauri-plugin-barcode-scanner

    v2

    The tauri-plugin-barcode-scanner has a limited attack surface because only the scan and cancel commands are exposed to the frontend.

    Key Security Properties

    • Data Isolation: Only the parsed barcode data is passed to the frontend. No raw camera images or video streams are accessible to the webview.
    • Platform Boundaries: Security relies on the mobile operating system (iOS/Android) boundaries.

    Developer Responsibilities

    • Untrusted Input: The plugin assumes the mobile OS correctly parses the QR code into text/links, but the content of the link/text is untrusted. Developers must perform additional validation and sanitization on any data received from a scan before using it in the application.
    • Permissions: The plugin requires camera permissions. On Android, the permission must be declared in the AndroidManifest.xml. Users can revoke these permissions at any time via system settings.

    Potential Threats

    • Silent Interaction/Overlay Attacks: A malicious or compromised frontend could attempt to create a non-transparent overlay on the camera view to scan QR codes without user awareness. While this is often considered a full application compromise, developers should use Content Security Policy (CSP) and other impact minimization methods to protect the frontend.

  5. Security assumptions and threat model for the log plugin

    v2

    When using the log plugin, be aware of the following security assumptions and potential threats:

    Security Assumptions

    • Unsanitized Input: Log file interpreting applications are assumed to be hardened, as input is not sanitized by the plugin.
    • Frontend Isolation: Log events in the Rust core are not leaked to the frontend unless TargetKind::Webview is explicitly configured.
    • Frontend Access: Log events generated in the frontend can be accessed from anywhere within the frontend.
    • No Secret Censoring: There is no built-in secret censoring; developers are responsible for what they log.

    Threats: Secret Leakage

    Secrets in logs can be leaked if the application's frontend is compromised (e.g., via XSS) AND one of the following is true:

    • TargetKind::Webview is enabled.
    • The secrets originate from frontend logs.

    Out of Scope

    • Exploits targeting the log viewer or file viewer used to access the logs.

  7. Understand the filesystem plugin threat model and scoping

    v2

    The filesystem plugin may allow access to the full filesystem available to the application process. Access confinement depends on the operating system:

    • Android/iOS: Access is typically confined by the OS to certain locations.
    • Linux/MacOS/Windows: Access depends on installation/packaging, but full access is often granted by default.

    Scoping Mechanism

    To prevent exposure of sensitive data, the plugin can be scoped to allow access only to specific base directories, files, or subdirectories.

    Important Security Constraints:

    • Frontend vs. Rust: Scoping effectively restricts calls made from the webviews/frontend code. Calls made from Rust can always circumvent the restrictions imposed by the scope.
    • Compile-time vs. Runtime: The scope is defined at compile time via permissions. However, if configured during plugin initialization, an application developer can grant or revoke access to specific files or folders at runtime by modifying the scope state through the runtime authority.

  9. How Rust and JavaScript share the same Store

    v2

    Stores created in Rust and stores created in JavaScript are stored in the application's resource table. This allows for seamless interoperability: a store accessed by a specific file path in Rust can be accessed by the same path in JavaScript, and vice versa.

    • In JavaScript: Use getStore or LazyStore with the matching path.
    • In Rust: Use get_store or store with the matching path.

  10. Understand the default permissions for the SQL plugin

    v2

    The SQL plugin comes with a default permission set that enables read-related operations and connection management. By default, the following permissions are granted:

    • allow-close: Allows closing a database connection.
    • allow-load: Allows loading a database connection.
    • allow-select: Allows executing SELECT queries.

    This configuration ensures that reading data and managing the connection lifecycle is available out-of-the-box without additional configuration.

  12. Configure HTTP plugin permissions

    v2

    The HTTP plugin uses a permission system to control fetch operations. The Default Permission set enables all core fetch operations (sending, reading, and cancelling) but does not allow any specific origins to be fetched by default.

    To successfully make network requests, you must manually configure and allow specific origins in your application's permission configuration before usage.