Orqestria Download
← Zurück zu Desktop-App-Entwickler

Skill · Version 1.0.0

Sichere Desktop-Grenzen

Begrenzt die Brücke zwischen Desktop-Webinhalten und nativen Fähigkeiten einschließlich lokal erreichbarer Server.

secure-ipc-native-boundaries

Teammitglieder mit diesem Skill

Entdecke, wie der Skill hilft

Wann ist der Skill hilfreich?

Nutze ihn bei Datei-, Prozess- oder Hostoperationen für Electron- oder Tauri-Oberflächen.

Wobei hilft er dir?

  • Stellt schmale typisierte IPC-Befehle statt roher Shell-Funktionen bereit.
  • Begrenzt Renderer-Rechte, Navigation und native Fähigkeiten.
  • Authentifiziert lokale APIs statt Loopback-Adressen zu vertrauen.

Das könntest du fragen

Prüfe nativen Dateizugriff und lokalen HTTP-Server einer Desktop-Vorschau. Lade nicht vertrauenswürdige Vorschau und versuche beliebiges Dateilesen. Die native Grenze weist es ab; unautorisierte Localhost-Anfragen erhalten keinen Zugriff.

Ausführliche Dokumentation

Hier findest du die ursprüngliche Anleitung, Beispiele und Prüfschritte des Skills in ihrer Originalsprache.

Details…Weniger anzeigen

Secure IPC & Native Boundaries

In a desktop app, XSS or untrusted content in the UI can escalate to full arbitrary code execution on the user's machine if the boundary between the web renderer and native OS capabilities is porous. Enforce strict capability isolation at every IPC and local network boundary.

Narrow, Typed IPC Contracts (Never Expose Raw Primitives!)

Forbidden Anti-Pattern Secure Pattern
Exposing raw ipcRenderer, fs, child_process, or shell.openExternal directly to window Expose narrow, domain-specific methods (window.desktop.selectProjectFolder(), window.desktop.openExternalDoc(docId)) via contextBridge.exposeInMainWorld or typed Tauri invoke commands
Generic file/command RPC (invoke('fs:read', arbitraryPath) or invoke('exec', cmdString)) Validate paths against user-approved dialog selections or scoped workspace roots (fs.realpath + boundary check); allowlist specific commands and pass argument arrays
Trusting every IPC call blindly in the main/Rust process Validate event.senderFrame.origin (Electron) or window/webview capability scopes (Tauri v2 src-tauri/capabilities/*.json), and validate all arguments with a strict schema

Mandatory Renderer & WebView Hardening

  1. Electron BrowserWindow Security Baseline:
    • Always enforce contextIsolation: true, sandbox: true, nodeIntegration: false, and webSecurity: true.
    • Intercept and block unexpected navigation and popups in the main process:
      • On contents.on('will-navigate', (event, url) => ...): block any navigation away from your app's own local origin.
      • On contents.setWindowOpenHandler(({ url }) => ...): deny new privileged BrowserWindow creation and route only explicitly allowlisted https: URLs to the system browser.
  2. Tauri v2 Capability & Scope Least Privilege:
    • Grant capabilities per window in src-tauri/capabilities/default.json.
    • Scope tauri-plugin-fs to explicit $APPDATA or user-selected directories (scope.allow_directory(...)) with deny rules on sensitive config/credential files, and restrict tauri-plugin-shell to declared sidecars or strict argument validators.

Securing Embedded Localhost HTTP / WebSocket Servers

When the desktop app runs a local HTTP/WebSocket backend on 127.0.0.1:<port>:

  • Never treat 127.0.0.1 as sufficient authentication: Any website open in the user's normal browser—or another local process—can send requests to http://127.0.0.1:<port>.
  • Mandatory loopback defenses:
    1. Bind strictly to 127.0.0.1 (never 0.0.0.0).
    2. Generate a high-entropy per-launch or owner-only (0600) bearer token and require it on every API and WebSocket request.
    3. Reject foreign Host headers (preventing DNS rebinding attacks) and reject foreign Origin headers.

Enthaltene Dateien 1

  • SKILL.md