Tine code audit report

[Dieterbe]

Before I use new software, i always have GPT (Codex) run a code audit. It looks for vulnerabilities, code quality issues, etc.
Here is what it wrote about the main project - another report about the dependencies will follow below. (spoiler: it looks quite good, just a couple of things that could be improved)

+++

Tine code audit report

Audit status: complete for the repository contents and local test/dependency checks available in this environment.

No source files were modified. Final git status --short was clean.

Executive conclusion

I found no confirmed exploitable vulnerability in the reviewed code paths.

The main confirmed hardening issue is that the Tauri application disables its Content Security Policy. There is also an unbounded backend asset-read option and a frontend test-suite reliability problem.
Dependency advisories require follow-up triage, but were not individually validated as exploitable application vulnerabilities.

The Rust core suite passed. The frontend suite did not complete successfully because its first Vitest stage failed one guard test due to a 5-second timeout; rerunning that test alone passed in 4.232 seconds.

Findings

M-1 — Tauri Content Security Policy is disabled

Severity: Medium hardening/security risk

Location: src-tauri/tauri.conf.json:40

Evidence:

"security": {
"csp": null
}

Impact:

The application receives no browser-enforced CSP defense-in-depth. If a future rendering, sanitizer, dependency, or templating defect introduces script injection, the webview has no CSP restriction to limit
script execution, resource loading, framing, or object/plugin content.

This is particularly relevant because the application renders user-controlled graph content and raw HTML-derived content.

Recommendation:

Define and test a restrictive Tauri CSP appropriate to the application’s actual IPC and asset-loading behavior. At minimum, explicitly constrain script, object, base, frame, image, style, font, and connection
sources. Validate it in packaged builds, not only development mode.

L-1 — read_asset permits an optional unlimited read

Severity: Low

Location: src-tauri/src/commands.rs:1781

Evidence:

max_bytes
.map_or_else(
|| g.read_asset(&name),
|limit| g.read_asset_limited(&name, limit),
)

The frontend callers currently pass explicit limits:

• Images use MAX_IMAGE_BYTES in src/assetCache.ts:188.
• PDFs use MAX_PDF_BYTES in src/components/PdfViewer.tsx:1008.

Impact:

A future caller, or an overlooked call path, can request an arbitrarily large asset into memory. Because this is a local desktop application, the likely impact is resource exhaustion rather than remote
exploitation.

Recommendation:

Prefer a mandatory backend limit, or enforce a conservative default when max_bytes is omitted. Keep the frontend limits as additional policy checks.

L-2 — Frontend guard test has a fragile 5-second timeout

Severity: Low; test reliability, not confirmed product failure

Location: src/conflictAuthority.guard.test.ts:127

Full frontend run result:

Test Files 1 failed | 238 passed | 1 skipped (240)
Tests 1 failed | 3884 passed | 1 skipped (3886)

FAIL src/conflictAuthority.guard.test.ts
has no markConflict call outside the save-result path

Error: Test timed out in 5000ms

The failing source scan took 4.232 seconds when rerun alone:

Test Files 1 passed (1)
Tests 8 passed (8)
Duration 5.64s
tests 4.24s

Impact:

The full frontend test command can fail nondeterministically under normal machine load even when the guard logic is correct.

Recommendation:

Either optimize the source scan or increase the test’s timeout to a justified value. Keep the focused test and add a bounded performance expectation if the scan is intended to remain fast.

Informational — Dependency advisories require triage

npm ci reported:

422 packages added
18 vulnerabilities
4 moderate
14 high

The command did not provide enough detail to determine which advisories affect production code versus development tooling, and no automatic remediation was applied.

Recommendation:

Run and review npm audit --omit=dev and the complete development dependency report. Prioritize exploitable runtime dependencies, then update or pin affected packages through normal review.

The Rust security catalog assessment also found no reusable review for this exact build identity:

No review exists for exact build identity
reusable = false
advisoryRefreshRequired = true

This is a review-coverage gap, not evidence of a known Rust vulnerability.

Positive controls observed

• Asset path resolution is performed through the graph filesystem abstraction before reading.

• Current frontend asset callers apply explicit image and PDF size limits.

• Raw HTML is passed through DOMPurify with an allowlist and additional URI checks.

• Embedded raw HTML frames use a sandbox attribute:

  allow-scripts allow-same-origin allow-popups allow-forms

• External links are routed through the backend/native allowlist rather than directly navigating the webview.

• Plugin execution is isolated through the worker/WASM boundary with timeout/termination handling.

• Build scripts reviewed for the application and relevant vendored components did not show unexpected shell downloads or first-party code-generation behavior.

• The repository contains extensive security and regression guard tests, including sanitizer, IPC, asset-size, external-link, plugin-boundary, storage-authority, and frontend/Rust parity checks.

Commands and outcomes

Repository and toolchain inspection

git rev-parse HEAD

Outcome: audited commit was:

e90023f

sha256sum Cargo.lock

Outcome:

c25c8955efa4e69b52dfadb9055063b7084366ffe7267882e53726037a90504f

rustc --version
cargo --version

Outcome:

rustc 1.96.0 (ac68faa20 2026-05-25)
cargo 1.96.0

cargo metadata --locked --format-version 1 --no-deps

Outcome: metadata resolved successfully with the lockfile. The workspace includes tine-core, the Tauri application, plugin SDK components, and the iOS picker component. Git dependencies resolved to the lockfile-
pinned revisions.

Static inspection commands included searches over:

rg -n 'read_asset|read_local_image|DOMPurify|sandbox|openExternal|MAX_IMAGE_BYTES|MAX_PDF_BYTES' src src-tauri

Outcome: reviewed the IPC command surface, asset readers, external-link handling, sanitizer paths, iframe handling, and frontend size limits.

Rust supply-chain review

swamp model method run rust-security-catalog assess
--repo-dir /home/dieter/.codex/rust-security-catalog
--input-file /tmp/tine-rust-review-assess.json
--json

Outcome: exact build identity was not present in the catalog; no reusable review was available and advisory refresh was required.

Cargo test attempts and cleanup

Earlier concurrent/duplicate Cargo jobs were identified with:

ps -eo pid=,ppid=,stat=,etime=,args= | rg '(^| )((cargo|rustc)( |$)|.*cargo test|.*rustc)'

Those stale audit-started jobs were terminated after confirming their PIDs. The process table was then clean.

The first isolated build attempt failed because the temporary filesystem quota was exhausted. The audit-created temporary targets consumed approximately 10.8 GB:

/tmp/tine-core-audit 4.6G
/tmp/tine-audit-target 6.2G

Only those audit-created directories were removed; the repository’s target/ directory was not touched.

Final core command:

CARGO_TARGET_DIR=/tmp/tine-core-audit
CARGO_INCREMENTAL=0
CARGO_BUILD_JOBS=1
cargo test --locked --offline -p tine-core

Captured exit code:

0

Outcome:

• Unit and integration tests passed.
• All reported test result lines had zero failures.
• The final doctest phase also passed with zero tests.
• The earlier run reported 1,459 core unit tests discovered.
• No Rust compiler, Cargo, or test process remained afterward.

Frontend dependency installation

npm ci

Outcome:

• 422 packages installed.
• 18 dependency advisories reported: 4 moderate and 14 high.
• Lifecycle scripts for edgedriver, esbuild, and geckodriver were blocked by the configured install-script policy.

Frontend suite

npm test

The repository’s test script expands to:

vitest run
vitest run --config vitest.render.config.ts
node scripts/test-deploy-profile.mjs
npm run test:anonymize-graph
npm run test:e2e-harness
npm run test:script-identifiers
npm run test:e2e-provenance
npm run test:fdroid-monitor

The first vitest run stage stopped the && chain after one timeout:

Test Files 1 failed | 238 passed | 1 skipped (240)
Tests 1 failed | 3884 passed | 1 skipped (3886)

The focused rerun:

npx vitest run src/conflictAuthority.guard.test.ts --reporter=verbose

Outcome:

Test Files 1 passed (1)
Tests 8 passed (8)

Because the first stage failed, the later render, deployment-profile, anonymization, E2E, provenance, identifier, and F-Droid commands were not reached by the npm test chain.

Final repository check

git status --short

Outcome: clean; no tracked or untracked repository changes.

Limitations

• The canonical external working-agreement files under /aux/koutecky/logseq/tine-agents/ were unavailable on this machine. Per your instruction, they were treated as developer-local context and excluded from the
  audit.

• No packaged desktop application was launched for dynamic webview/CSP validation.

• No fuzzing, penetration testing, or hostile plugin execution campaign was performed.

• Dependency advisories were reported by npm but not individually mapped to production reachability.

• The frontend full chain was blocked at its first Vitest stage by the timeout above; later frontend test stages remain unverified.

• The audit assessed the checked-out commit only and did not review deployment infrastructure outside this repository.

Final disposition

The repository is not showing a confirmed high-severity security defect from this audit. Before treating it as fully hardened, I recommend:

1. Add a restrictive CSP.
2. Make backend asset limits mandatory or default-bounded.
3. Fix or relax the fragile frontend guard-test timeout.
4. Triage the 18 npm advisories.
5. Run the remaining frontend stages after the first Vitest failure is resolved.

[Dieterbe]

Tine dependency audit

Audit date: 2026-09-18

Conclusion

The dependency set should not currently be marked as fully trusted. The recommended disposition is trusted-with-constraints, pending advisory remediation and a fresh scan.

The audit covered the exact locked Rust graph, checksums, Git revisions, dependency build scripts, procedural-macro capability surfaces, OSV/RustSec advisories, and npm advisories. It was not a line-by-line audit of all 668 Rust crates or all JavaScript package source files.

Rust dependency scope

• Full locked workspace graph: 668 packages.
• 659 crates.io packages.
• Git dependencies:
  • lsdoc 0.5.7 at ab054c3f2cd52c5599564fb0433116c47b0b782.
  • tine-storage 0.24.0 at 5913bc4bb0cbf7bef3a7a341ac0b6b360129f04d.
  • tao 0.35.3 at 07f3742b1833b64be27b1ef991e38d557d4276c9.
• Local vendored dependency: cap-primitives 4.0.2.
• Target/compiler: x86_64-unknown-linux-gnu, Rust 1.96.0.

Commands:

CARGO_HOME=/tmp/tine-dependency-cargo-home cargo fetch --locked
CARGO_HOME=/tmp/tine-dependency-cargo-home cargo metadata --locked --format-version 1
cargo tree --locked -e features
cargo tree --locked -i <affected-package>

All registry sources were fetched with the lockfile, and Git dependencies were pinned to the exact revisions above. Cargo checksums were used for registry packages.

Rust advisory findings

High priority: rustls 0.23.41

Advisory: RUSTSEC-2026-0285

Fixed in rustls 0.23.45. It is used transitively by reqwest and tauri-plugin-updater; project comments indicate rustls is used by the updater on Linux/macOS. The issue permits acceptance of TLS 1.3 handshake messages at the wrong encryption level.

Recommendation: update the lockfile to at least rustls 0.23.45, then test updater behavior.

Medium: ammonia 4.1.3

Advisory: RUSTSEC-2026-0213

Fixed in ammonia 4.1.4. This is a direct tine-core dependency. The vulnerable behavior involves SVG animate/set elements producing JavaScript URLs. Tine's current Rust and TypeScript raw-HTML allowlists exclude SVG elements, so the affected behavior was not reachable through the reviewed policy.

Recommendation: update anyway, so safety does not depend on the allowlist remaining unchanged.

Medium: event-listener 5.4.1

Advisory: RUSTSEC-2026-0221

Fixed in 5.4.2. It is transitive through zbus and the Tauri single-instance stack. The advisory describes an unsound Send/Sync implementation for StackSlot.

Recommendation: update to 5.4.2 or a dependency release that includes it.

Medium: im 15.1.0 and sized-chunks 0.6.5

Advisories:

• RUSTSEC-2023-0126
• RUSTSEC-2026-0255

im is a direct tine-core dependency. Its sized-chunks dependency has a panic-safety use-after-free/double-free advisory, while im has an aliasing violation in OrdSet insertion.

No im::, OrdSet, or OrdMap use was found in first-party tine-core source. That lowers immediate reachability, but the crates are still compiled into the dependency graph.

Recommendation: remove the unused direct dependency if confirmed unnecessary. Otherwise replace it with maintained alternatives or isolate and review the exact APIs used.

Conditional: glib 0.18.5

Advisories: RUSTSEC-2024-0429 and GHSA-wrw7-89jp-8q8g.

Fixed in glib 0.20.0. It is transitive through GTK/Tauri. The issue affects glib::VariantStrIter; no first-party use of that API was found.

Recommendation: track the Tauri/GTK upgrade path and validate platform compatibility before upgrading.

Not affected by the locked version

The workspace contains quick-xml 0.41.0, which is the fixed version for the reported duplicate-attribute and namespace-allocation advisories.

Unmaintained crates

The advisory database reports these as unmaintained:

atomic-polyfill, bitmaps, im, proc-macro-error, sized-chunks, unic-char-range, unic-common, unic-char-property, unic-ucd-version, and unic-ucd-ident.

These are maintenance and supply-chain risks rather than confirmed vulnerabilities. The im/sized-chunks combination is more serious because it also has unsoundness advisories.

Build scripts and procedural macros

All resolved dependency build.rs files and procedural-macro sources were mechanically scanned for process execution, network access, filesystem mutation, dynamic loading, embedded binaries, and generated-source behavior.

Observed behavior was expected:

• Rust compiler/version probes.
• Native-library detection for GTK, WebKit, OpenSSL, SQLite, and related platform libraries.
• Platform-specific swift, xcrun, xcodebuild, and NASM probes.
• Tauri ACL/permission generation.
• Proc-macro source generation and formatting.

No dependency build script showed an unexpected downloader, arbitrary shell pipeline, or suspicious network exfiltration behavior.

This was a capability scan and focused review, not an exhaustive manual audit of every dependency source line.

JavaScript dependency audit

Commands:

npm ci
npm audit --json
npm ls dompurify vitest webdriverio extract-zip @wdio/utils --all

Results:

18 vulnerabilities
4 moderate
14 high
0 critical

Most high-severity advisories are in development or browser-automation tooling. The most relevant direct dependencies are:

• dompurify 3.4.11: direct runtime dependency, moderate advisory.
• vitest 3.2.7: direct development dependency, moderate advisory.
• webdriverio 9.29.0: direct development dependency with high-severity transitive paths.

Notable transitive advisories include extract-zip symlink/arbitrary-write issues, brace-expansion denial of service, browserslist memory/prototype issues, deepmerge-ts recursion exhaustion, fast-xml-parser resource exhaustion, ip-address SSRF parsing issues, postcss source-map path traversal, and multiple undici HTTP parsing/cache issues.

Recommendation:

1. Update dompurify to a fixed release.
2. Update vitest.
3. Update webdriverio and its browser-tooling dependencies.
4. Run npm audit --omit=dev separately to distinguish production exposure from test-only exposure.
5. Review lockfile changes instead of applying npm audit fix --force blindly.

Trust disposition and follow-up

The dependency set should remain trusted-with-constraints until:

1. rustls, ammonia, and event-listener are updated.
2. The im/sized-chunks chain is removed, replaced, or explicitly justified.
3. The GTK/glib upgrade path is reviewed.
4. Direct vulnerable JavaScript dependencies, especially DOMPurify, are updated.
5. Development-only advisories are triaged.
6. The advisory scan is repeated after lockfile changes.

[martinkoutecky]

Thank you for both reports. They were specific enough to act on finding by finding. We re-checked every item against current code; here is where each stands.

Code audit

Finding	Status
M-1 CSP disabled	Fixed, released in 0.7.0. tauri.conf.json now sets an explicit policy (default-src 'self', object-src 'none', base-uri 'none', constrained script/style/connect/img/media/font/worker/frame sources). Following your "validate it in packaged builds" point, a new test builds the production (custom-protocol) context and asserts the compiled CSP equals the configured one; a deliberate csp: null override makes it fail.
L-1 optional unlimited read_asset	Still open. Current callers all pass limits, but the IPC still accepts an omitted bound. Choosing the default (mandatory bound vs. a fallback budget) is a product decision, so it's tracked rather than changed silently.
L-2 guard test 5 s timeout	Gone. That guard test and the module it scanned no longer exist in the current codebase; the full frontend suite passes.
Dependency advisories	See below.

Dependency audit (on the Beta line now, in the next Beta, 0.8.0-beta.1)

• Updated: rustls 0.23.45 (+ rustls-webpki 0.103.15), ammonia 4.1.4, event-listener 5.4.2, wayland-scanner 0.31.11 (drops the affected quick-xml), DOMPurify 3.4.16, Solid 1.9.17, WebdriverIO 9.32.0, plus dev-only patch updates. cargo audit vulnerability findings: 4 → 0. npm audit --omit=dev: 5 → 1.
• Already gone: im and sized-chunks are no longer in the dependency graph.
• Retained, with reasons:
  • glib 0.18.5: the fixed glib ≥ 0.20 isn't compatible with the GTK3/WebKitGTK stack Tauri currently uses. It moves with a native-stack migration, and Tine doesn't call the affected VariantStrIter.
  • katex 0.16.47 (the one remaining production advisory, low): exploitable only with pre-existing prototype pollution, and Tine passes explicit options.
  • vitest 3 / tinypool, basic-ftp, extract-zip: test and E2E tooling only, not in the shipped app. They wait for upstream fixes or a Vitest 4 migration.

Claude (working on Martin's behalf)

[martinkoutecky]

Follow-up: the runtime part of the dependency update is now also in the stable line, released as Tine 0.7.1:

• rustls 0.23.45 (+ rustls-webpki 0.103.15), used by the desktop updater
• ammonia 4.1.4 and DOMPurify 3.4.16 (the HTML sanitizers)
• event-listener 5.4.2, wayland-scanner 0.31.11 (drops the affected quick-xml), Solid 1.9.17

Nothing else changed in 0.7.1. Stable keeps WebdriverIO at 9.29.0. It is test tooling only, not part of the shipped app, and 9.32.0 broke one of our release E2E journeys. The Beta line carries the full update described above. The retained items (glib, katex, test-only tooling) are unchanged, for the reasons given there.

Thanks again for the audit. If you rerun your scans on 0.7.1 and something still shows up, comment here.

Claude (working on Martin's behalf)