search

tauri-apps / tauri

Build smaller, faster, and more secure desktop applications with a web frontend.
https://tauri.app
Apache License 2.0
82.3k stars 2.47k forks source link

Trying to check if an object is an instance of SharedArrayBuffer throws error. #1522

Open redsuperbat opened 3 years ago

redsuperbat commented 3 years ago

Describe the bug During runtime Tauri interprets SharedArrayBuffer as a variable when checking instance types using instanceof. For example this code:

console.log({} instanceof SharedArrayBuffer);

would throw :

Unhandled Promise Rejection: ReferenceError: Can't find variable: SharedArrayBuffer

instead of printing false to the console.

To Reproduce

  1. Run the code console.log({} instanceof SharedArrayBuffer);
  2. Throws error

Expected behavior Should just print false

Platform and Versions (please complete the following information):

OS: Ubuntu 20.10 Node: v15.3.0 NPM: 7.0.14 Rustc: 1.50.0

amrbashir commented 3 years ago

works fine for me, it prints false, do you have a minimal repo where the error happens ?

redsuperbat commented 3 years ago

Sure here is a temporary repo with a blank vuejs app.

https://github.com/redsuperbat/temp-tauri-repo

The error occurs in the main.ts file on the line 

console.log({} instanceof SharedArrayBuffer);

To reproduce with the repo:

  1. clone repo
  2. run npm install
  3. open terminal and start server with npm run serve
  4. open second terminal and run npm run tauri dev
  5. inspect and console should have the error
amrbashir commented 3 years ago

I still see false printed to the console. I am on windows though. I will have to test it on my linux machine later.

amrbashir commented 3 years ago

I can see the error happening on my linux. Tauri uses WebkitGTK on linux, So I went to dig a little bit and found that WebkitGTK has removed the SharedArrayBuffer. See https://webkitgtk.org/2018/01/10/webkitgtk2.18.5-released.html

nothingismagick commented 3 years ago

I guess that it was removed due to Spectre (note the deprecation of high-resolution timers too). We should probably nudge the webkit devs to look into re-enabling.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#security_requirements

This is definitely upstream and not anything either Tauri nor WRY can do anything about. Sorry

nothingismagick commented 3 years ago

It seems that this should actually be reenabled in a recent version:

wry is consuming an old version:

webkit2gtk = { version = "0.11", features = [ "v2_8" ] }

There are a few other ones - @wusyong - we should probably be closer to a modern version, no? https://github.com/gtk-rs/webkit2gtk-rs/blob/9c1c05f47352b7923d2cb8c472267017ab7b7426/Cargo.toml#L23-L39

lucasfernog commented 3 years ago

Using v2_28 didn't solve the problem.

wusyong commented 3 years ago

I couldn't find the release note in WebkitGtk saying they re-enabled it. So I think update the version won't help.

@nothingismagick We keep the older version because of this issue tauri-apps/wry#51 . It will require updating some upstream crates. I'll find some time to look into it again.

nothingismagick commented 2 years ago

Have we checked lately if this has been resolved in the recent webkitgtk? @wusyong @lucasfernog

lucasfernog commented 2 years ago

I tried to set the headers on macOS and window.crossOriginIsolated is still false.

WindowBuilder::new(
        app,
        "main",
        tauri::WindowUrl::App("index.html".into()),
      )
      .title("Tauri")
      .on_web_resource_request(|req, resp| {
        if req.uri().starts_with("tauri://") {
          resp.headers_mut().insert(
            "Cross-Origin-Opener-Policy",
            "same-origin".try_into().unwrap(),
          );
          resp.headers_mut().insert(
            "Cross-Origin-Embedder-Policy",
            "require-corp".try_into().unwrap(),
          );
          println!("done");
        }
      })
      .build()?;

This might not be supported on webviews at all.

wusyong commented 2 years ago

Still no on linux either.

lucasfernog commented 2 years ago

I tried to set the headers on macOS and window.crossOriginIsolated is still false.

WindowBuilder::new(
        app,
        "main",
        tauri::WindowUrl::App("index.html".into()),
      )
      .title("Tauri")
      .on_web_resource_request(|req, resp| {
        if req.uri().starts_with("tauri://") {
          resp.headers_mut().insert(
            "Cross-Origin-Opener-Policy",
            "same-origin".try_into().unwrap(),
          );
          resp.headers_mut().insert(
            "Cross-Origin-Embedder-Policy",
            "require-corp".try_into().unwrap(),
          );
          println!("done");
        }
      })
      .build()?;

This might not be supported on webviews at all.

This solution can be used on Windows though.

pwespi commented 2 years ago

I tried to look for information regarding webkitgtk re-enabling SharedArrayBuffer, but I couldn't find anything.

Does anybody know anything about that?

pwespi commented 2 years ago

I just tested on Ubuntu 22.04 with libwebkit2gtk-4.0-dev/jammy,now 2.36.0-2ubuntu1. Using the localhost plugin (https://github.com/tauri-apps/tauri/issues/3917#issuecomment-1104433755), I can get window.crossOriginIsolated to be true, but SharedArrayBuffer is still not available.

jlarmstrongiv commented 1 year ago

Supporting SharedArrayBuffer would unblock access to packages like:

Does anyone have any updates or workarounds?

franz-fletcher commented 1 year ago

WebKit/WebKit#8578 (comment) describes the implementation and platform support surface attached to the merged changes that enable access to SharedArrayBuffer Objects docs using Atomics.waitAsync() docs on the main thread running JavaScriptCore.

Might be worth re-running tests on latest release of iOS, OSX and a linux build with updated WebKitGTK

pwespi commented 8 months ago

WebKit/WebKit#8578 (comment) describes the implementation and platform support surface attached to the merged changes that enable access to SharedArrayBuffer Objects docs using Atomics.waitAsync() docs on the main thread running JavaScriptCore.

Might be worth re-running tests on latest release of iOS, OSX and a linux build with updated WebKitGTK

@franz-fletcher Thank you for the link!

I just tested on Ubuntu 22.04.3 with libwebkit2gtk-4.0-dev/jammy-updates,jammy-security,now 2.42.3-0ubuntu0.22.04.1 and it's unfortunately still the same: I can get window.crossOriginIsolated to be true, but SharedArrayBufferis still not available.

pwespi commented 8 months ago

This is the app I'm using for testing: https://github.com/pwespi/tauri-app-shared-array-buffer (uses the localhost plugin).

The frontend part of it is deployed to https://tauri-app-shared-array-buffer.vercel.app/, such that it can also be used to test browsers.

Notable results:

Test SharedArrayBuffer available
Tauri App on Ubuntu 22.04.3, WebKitGTK 2.42.3 false
Epiphany Browser on Ubuntu 22.04.3, WebKitGTK 2.42.3 false
Tauri App on macOS 14.2.1 true
Safari on macOS 14.2.1 true
Safari on iOS 17.2.1 true
liudonghua123 commented 8 months ago

This is the app I'm using for testing: https://github.com/pwespi/tauri-app-shared-array-buffer (uses the localhost plugin).

The frontend part of it is deployed to https://tauri-app-shared-array-buffer.vercel.app/, such that it can also be used to test browsers.

Notable results:

Test SharedArrayBuffer available Tauri App on Ubuntu 22.04.3, WebKitGTK 2.42.3 false Epiphany Browser on Ubuntu 22.04.3, WebKitGTK 2.42.3 false Tauri App on macOS 14.2.1 true Safari on macOS 14.2.1 true Safari on iOS 17.2.1 true

@pwespi Hi, I tried your project to package webvm, but the tauri-plugin-localhost plugin use tiny-http which do not support range features currently.

See also https://github.com/tauri-apps/plugins-workspace/issues/880.

halfkai commented 4 months ago

after setting COOP/COEP headers, start app with env: __XPC_JSC_useSharedArrayBuffer=1 on MacOS will do the trick.

vladfaust commented 4 days ago

Current state:

image