From 30ee07c2e388d4328595639ce264a88bc5620cdd Mon Sep 17 00:00:00 2001 From: Ivan Date: Fri, 27 Feb 2026 07:01:32 +0100 Subject: [PATCH] fix: scope DMABUF workaround to Linux+NVIDIA, add origin validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address CodeRabbit review feedback: - Makefile: only set WEBKIT_DISABLE_DMABUF_RENDERER=1 when running on Linux with an NVIDIA GPU detected via lspci - main.rs: validate webview origin before auto-granting microphone permission — only allow for trusted local origins (tauri://, localhost, 127.0.0.1) Co-Authored-By: Claude Opus 4.6 --- Makefile | 6 +++++- tauri/src-tauri/src/main.rs | 14 ++++++++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 94c841d3..3ff4080c 100644 --- a/Makefile +++ b/Makefile @@ -79,7 +79,11 @@ dev: ## Start backend + desktop app (parallel) @echo -e "$(YELLOW)Note: If Tauri fails, run 'make build-server' first or use separate terminals$(NC)" @trap 'kill 0' EXIT; \ $(MAKE) dev-backend & \ - sleep 2 && WEBKIT_DISABLE_DMABUF_RENDERER=1 $(MAKE) dev-frontend & \ + sleep 2 && if [ "$$(uname)" = "Linux" ] && lspci 2>/dev/null | grep -qi nvidia; then \ + WEBKIT_DISABLE_DMABUF_RENDERER=1 $(MAKE) dev-frontend; \ + else \ + $(MAKE) dev-frontend; \ + fi & \ wait dev-backend: ## Start FastAPI backend server diff --git a/tauri/src-tauri/src/main.rs b/tauri/src-tauri/src/main.rs index 19bf70aa..83629070 100644 --- a/tauri/src-tauri/src/main.rs +++ b/tauri/src-tauri/src/main.rs @@ -651,9 +651,19 @@ pub fn run() { } // Auto-grant UserMediaPermissionRequest (microphone access) - wk_webview.connect_permission_request(move |_, request: &webkit2gtk::PermissionRequest| { + // Only for trusted local origins (Tauri dev server or custom protocol) + wk_webview.connect_permission_request(move |webview, request: &webkit2gtk::PermissionRequest| { if request.is::() { - request.allow(); + let uri = WebViewExt::uri(webview).unwrap_or_default(); + let is_trusted = uri.starts_with("tauri://") + || uri.starts_with("https://tauri.localhost") + || uri.starts_with("http://localhost") + || uri.starts_with("http://127.0.0.1"); + if is_trusted { + request.allow(); + return true; + } + request.deny(); return true; } false