Repository navigation
fix(cli): percent-decode request paths in the builtin dev server (fix #12763) - #16436
Merged
Merged
Conversation
The builtin dev server, which `tauri dev` uses when `build.devUrl` is not set, looked files up with the raw request path. A request for `/my%20font.woff2` searched for a file literally named `my%20font.woff2`, did not find it and fell back to `index.html`, so files with spaces or non-ASCII characters in their names could not be loaded in development, while they work in production builds. Decode the path like the `tauri://` protocol does. `fs_read_scoped` still rejects decoded paths outside of the served directory. Fixes tauri-apps#12763 Co-Authored-By: Claude Opus 5.5 <[email protected]>
amrbashir
reviewed
Oct 31, 2026
amrbashir
approved these changes
Oct 31, 2026
Contributor
Package Changes Through 4106246There are 7 changes which include @tauri-apps/api with patch, tauri-bundler with patch, tauri-cli with patch, @tauri-apps/cli with patch, tauri with patch, tauri-runtime-wry with patch, tauri-utils with patch Planned Package VersionsThe following package releases are the planned based on the context of changes in this pull request.
Add another change file through the GitHub UI by following this link. Read about change files or the docs at github.com/jbolda/covector |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #12763
The builtin dev server, which
tauri devuses whenbuild.devUrlis not set, looked files up with the raw request path fromUri::path(), which is still percent-encoded. A stylesheet withsrc: url("my font.woff2")makes the webview request/my%20font.woff2. The server looked for a file literally namedmy%20font.woff2, did not find it and fell back toindex.html. So the font, or any other file with spaces or non-ASCII characters in its name, failed to load in development. Production builds are not affected becauseAppManager::get_assethas percent-decoded the asset path since #1938.This PR decodes the path the same way, with
percent_decode_str(..).decode_utf8_lossy(), before the lookup. Decoding can produce..or an absolute path (%2E%2E,%2F), but every candidate still goes throughfs_read_scoped. That function canonicalizes the path and rejects anything outside of the served directory.percent-encodingis now a direct dependency oftauri-cli. It was already in the lockfile, used bytauriandurl.Testing
dev::builtin_dev_server::tests::serves_percent_encoded_pathstest calls the request handler for/my%20font.woff2and/%E9%A1%B5%E9%9D%A2.css(页面.css) and checks that the file contents are returned. It also checks that/%2E%2E/secret.txt,/..%2Fsecret.txtand a percent-encoded absolute path don't return a file outside of the served directory. Without the fix, the first request returnsindex.htmland the test fails.cargo test -p tauri-cli,cargo clippy -p tauri-cli --all-targets -- -D warningsandcargo fmt --checkpass on Linux.I used Claude Code to write this change.