tauri-apps / tauri

Build smaller, faster, and more secure desktop and mobile applications with a web frontend.
https://tauri.app
Apache License 2.0
85.25k stars 2.58k forks source link

Shell: echo dont show env vars [bug] #8823

Open wallacerenan opened 9 months ago

wallacerenan commented 9 months ago

Describe the bug

tauri.conf.json:

{
  "shell": {
    "all": true,
    "execute": true,
    "sidecar": true,
    "open": true,
    "scope": [
      {
        "name": "echo",
        "cmd": "echo",
        "args": true
      }
    ]
  }
}
fn main() {
    ...
    let _ = fix_path_env::fix_all_vars();
    ...
const MAC_SDK_PATH = '$ANDROID_HOME';

const getSdkByPlatform = (platformName: Platform) => {
  switch (platformName) {
    case 'darwin':
      return MAC_SDK_PATH;
    case 'linux':
    case 'ios':
    case 'freebsd':
    case 'dragonfly':
    case 'netbsd':
    case 'openbsd':
    case 'solaris':
    case 'android':
    case 'win32':
      return '';
  }
};

export async function getSDKPathCommand() {
  const platformName = await platform();
  const path = getSdkByPlatform(platformName);
  const command = new Command('echo', path);
  const output = await command.execute();
  const path= output.stdout;
  console.log(path); // here -> the value is ${ANDROID_HOME}, I imagine the expected command was not executed: echo $ANDROID_HOME
  return path;
}

the function getSDKPathCommand

Reproduction

No response

Expected behavior

log the shell var $ANDROID_HOME (/Users/{username}/Library/Android/sdk), but it is logging: $ANDROID_HOME

Full tauri info output

[✔] Environment
    - OS: Mac OS 14.2.1 X64
    ✔ Xcode Command Line Tools: installed
    ✔ rustc: 1.75.0 (82e1608df 2023-12-21)
    ✔ cargo: 1.75.0 (1d8b05cdd 2023-11-20)
    ✔ rustup: 1.26.0 (5af9b9484 2023-04-05)
    ✔ Rust toolchain: stable-aarch64-apple-darwin (default)
    - node: 18.17.0
    - pnpm: 8.10.5
    - yarn: 1.22.21
    - npm: 10.3.0

[-] Packages
    - tauri [RUST]: 1.5.4
    - tauri-build [RUST]: 1.5.1
    - wry [RUST]: 0.24.7
    - tao [RUST]: 0.16.7
    - @tauri-apps/api [NPM]: 1.5.3
    - @tauri-apps/cli [NPM]: 1.5.9

[-] App
    - build-type: bundle
    - CSP: unset
    - distDir: ../out
    - devPath: http://localhost:3000/
    - framework: React
    - bundler: Vite

Stack trace

No response

Additional context

No response

FabianLars commented 9 months ago

Can you check if it works if you use sh as the command binary instead of echo directly?

wallacerenan commented 9 months ago

Can you check if it works if you use sh as the command binary instead of echo directly?

Any ideas on how to do this?

FabianLars commented 9 months ago

Change cmd in tauri.conf to "sh" and the args from path to ["-c", "'echo $ANDROID_HOME'" (note that the second arg is in 2 sets of quotes, one for the rust string and one for the -c string input).

I'm on my phone so I may not remember it correctly.

wallacerenan commented 9 months ago

Change cmd in tauri.conf to "sh" and the args from path to ["-c", "'echo $ANDROID_HOME'" (note that the second arg is in 2 sets of quotes, one for the rust string and one for the -c string input).

I'm on my phone so I may not remember it correctly.

Same error here :(

{
    "name": "run-sh",
    "cmd": "sh",
    "args": true
}
export async function getSDKPathCommand() {
  const command = new Command('run-sh', "-c 'pwd'");
  const output = await command.execute();
  console.log(output);
  return command;
}

console: result: ""

naman-crabnebula commented 9 months ago

Hi @wallacerenan ,

Actually, Rust uses another approach to Command , that is, you have to mention each argument separately. Please read:

https://doc.rust-lang.org/std/process/struct.Command.html

So, arguments are directly passed to echo command via args, and 1 arg at a time, hence prevent potential Shell Injection vulnerability.

So, instead of

const command = new Command('echo', path);

You should use


const command = new Command("echo").arg("path");