From ba5950bf0254b56aebb56c663942b9dcfee940e7 Mon Sep 17 00:00:00 2001
From: sim <sim@local>
Date: Sun, 5 Jul 2026 00:28:30 +0800
Subject: [PATCH] fix(deps): patch tauri-plugin-shell CVE (GHSA-c9pr-q8gx-3mgp)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

@tauri-apps/plugin-shell (npm) 与 tauri-plugin-shell (crate) 的声明下限
——npm `^2.0.1`、crate `"2"`——都落在 GHSA-c9pr-q8gx-3mgp 影响范围
（`< 2.2.1`，CRITICAL：`open` 端点作用域校验绕过，可致 RCE）。本项目
src/lib/ipc/utils.ts 正是通过该 `open` 端点打开外链，属受影响用法。

两个 lockfile 实际已解析到 2.3.5，但清单声明的下限仍是漏洞版本，供应链
扫描（SkillSpector SC4）因此读取到 2.0.1 报警。此处仅把两侧声明下限抬到
最新安全版 2.3.5，使清单与锁定版本一致、扫描不再命中；解析版本不变，无
运行时行为变化。

Closes #668
---
 openless-all/app/package-lock.json    | 2 +-
 openless-all/app/package.json         | 2 +-
 openless-all/app/src-tauri/Cargo.toml | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/openless-all/app/package-lock.json b/openless-all/app/package-lock.json
index a15ba2de..0e51c117 100644
--- a/openless-all/app/package-lock.json
+++ b/openless-all/app/package-lock.json
@@ -12,7 +12,7 @@
         "@tauri-apps/api": "^2.1.1",
         "@tauri-apps/plugin-autostart": "^2.5.1",
         "@tauri-apps/plugin-dialog": "^2.7.1",
-        "@tauri-apps/plugin-shell": "^2.0.1",
+        "@tauri-apps/plugin-shell": "^2.3.5",
         "@tauri-apps/plugin-updater": "^2.10.1",
         "@types/dompurify": "^3.0.5",
         "dompurify": "^3.4.8",
diff --git a/openless-all/app/package.json b/openless-all/app/package.json
index ab314f71..3a387bd5 100644
--- a/openless-all/app/package.json
+++ b/openless-all/app/package.json
@@ -27,7 +27,7 @@
     "@tauri-apps/api": "^2.1.1",
     "@tauri-apps/plugin-autostart": "^2.5.1",
     "@tauri-apps/plugin-dialog": "^2.7.1",
-    "@tauri-apps/plugin-shell": "^2.0.1",
+    "@tauri-apps/plugin-shell": "^2.3.5",
     "@tauri-apps/plugin-updater": "^2.10.1",
     "@types/dompurify": "^3.0.5",
     "dompurify": "^3.4.8",
diff --git a/openless-all/app/src-tauri/Cargo.toml b/openless-all/app/src-tauri/Cargo.toml
index aa103296..830a690d 100644
--- a/openless-all/app/src-tauri/Cargo.toml
+++ b/openless-all/app/src-tauri/Cargo.toml
@@ -21,7 +21,8 @@ cc = "1.1"
 # macos-private-api must live in [dependencies] so tauri_build can match tauri.conf.json
 # macOSPrivateApi; tray-icon stays desktop-only in the target table below.
 tauri = { version = "~2.11", features = ["macos-private-api"] }
-tauri-plugin-shell = "2"
+# 锁 >=2.3.5 修复 GHSA-c9pr-q8gx-3mgp：tauri-plugin-shell `open` 端点作用域校验绕过（CRITICAL，issue #668）。
+tauri-plugin-shell = "2.3.5"
 tauri-plugin-dialog = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"