MacOS sandboxing feature #16090

maxkatz6 · 2024-06-23T00:55:39Z

What does the pull request do?

This PR resurrects idea of old PR - #6540.
In short, in order to make macOS app working with the AppStore sandbox, developers need to be careful with how they interact with the File System:

Each operation should be wrapped in secure scope session - [NSURL startAccessingSecurityScopedResource] + [NSURL stopAccessingSecurityScopedResource].
When any file or folder are opened via picker, developers need to bookmark access to these files in order to reuse them between app sessions. Simply saving full file path won't work, as OS might not allow direct file access.

Old PR was created when we didn't have a better idea how this API should look like. And later it was implemented for mobile and browser platforms with new StorageProvider API, where we fully support sandboxed bookmarks. macOS platform was temporary skipped due to complexity and chance of introducing bugs to the existing backend (+it was low priority).

How to test

Open ControlCatalog, Dialogs page.
Open any file or folder
Copy "bookmark" text field
Reopen the app, dialogs page, input the same bookmark value.
Press "read folder/file bookmark".
The same folder/file should be opened.
Additionally, all other storage related operations should function as they did before without regressions.

Extra: use https://stackoverflow.com/questions/24947661/os-x-app-testing-for-sandbox-violations

Breaking changes

Two breaking changes:

BclStorageFile/Folder.SaveBookmarkAsync now returns encoded string instead of original path (only Windows and Linux). MacOS implementation also returns an actual bookmark from the OS.
By default, macOS now uses [NSURL startAccessingSecurityScopedResource] each time when user accesses file, including stream operations (we have a stream wrapper for that). It's not a breaking change by itself, but it's rather a big impact that might introduce unwanted bugs. It's possible to disable this behavior by passing AvaloniaNativePlatformOptions.AppSandboxEnabled = false, which will revert to old non-sandboxed APIs.

Fixed issues

Fixes #6537
Reopens #6540

Might solve some rare/random issues with initial directory not being applied

…project

…upposed to be true. Plain BCL doesn't provide files bookmarking.

…dboxing

avaloniaui-bot · 2024-06-23T01:32:39Z

You can test this PR using the following package version. 11.2.999-cibuild0049199-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

kekekeks · 2024-06-24T09:08:14Z

What is wrong with BCL provider to have support for "fake" bookmarks? Weren't those supposed to make it easier to debug relevant code paths on Windows/Linux?

kekekeks · 2024-06-24T09:09:11Z

Maybe we could return some mangled path that can't be used as a filename? i. e. just use base64 encoding.

avaloniaui-bot · 2024-07-09T02:59:23Z

You can test this PR using the following package version. 11.2.999-cibuild0049947-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

maxkatz6 · 2024-07-13T01:53:30Z

@kekekeks re-enabled BCL bookmarks, as base64 strings.

avaloniaui-bot · 2024-07-13T01:53:45Z

You can test this PR using the following package version. 11.2.999-cibuild0050065-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

avaloniaui-bot · 2024-07-13T02:38:19Z

You can test this PR using the following package version. 11.2.999-cibuild0050083-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

kekekeks · 2024-07-13T09:34:19Z

Can we also prefix bookmarks, so we could distinguish between types of those if we make changes later? Since we already have to make behavioral breaking changes here, I'd like to future-proof this area.

maxkatz6 · 2024-07-15T23:55:22Z

@kekekeks bookmarks are now prefixed on all platforms.

avaloniaui-bot · 2024-07-16T00:15:39Z

You can test this PR using the following package version. 11.2.999-cibuild0050119-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

avaloniaui-bot · 2024-07-16T01:37:24Z

You can test this PR using the following package version. 11.2.999-cibuild0050123-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

avaloniaui-bot · 2024-07-16T04:57:54Z

You can test this PR using the following package version. 11.2.999-cibuild0050128-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

kekekeks · 2024-07-16T07:10:10Z

src/Avalonia.Base/Platform/Storage/FileIO/StorageBookmarkHelper.cs

+{
+    private const int PrefixLength = 16;
+
+    private static ReadOnlySpan<byte> FakeBclBookmarkPlatform => "avalonia-bcl"u8;


nit: won't it make more sense to have this prefix in the BCL provider itself?

I intended to make EncodeBclBookmark/TryDecodeBclBookmark methods visible outside of BclStorageProvider. Like it's used in macOS backend now:
https://github.com/AvaloniaUI/Avalonia/pull/16090/files/47c3e3cdfa3496a46240fd5141358c81b7b5f340#diff-01a97878717fd9596b20885a6a096cda57ec8f4b1c98d00961d5a1fa348d2c77R137-R140

kekekeks · 2024-07-16T07:13:40Z

Are prefixes separated via some character from the rest of the content? Would make more sense for it to be android:<content> than android<content>.

src/Avalonia.Base/Platform/Storage/IStorageBookmarkItem.cs

maxkatz6 · 2024-07-16T07:20:08Z

Are prefixes separated via some character from the rest of the content? Would make more sense for it to be android: than android.

Currently, "platform" part of the bookmark length is const 16 bytes.

kekekeks · 2024-07-16T07:22:57Z

src/Avalonia.Base/Platform/Storage/FileIO/StorageBookmarkHelper.cs

+            return true;
+        }
+
+        localPath = null;


We should probably also check for the bookmark format created by older versions. Depending on the platform that would be a StartsWith("/") /Regex.IsMatch(@"^[A-Za-z]:[\\/]") check. Could also follow with a File.Exists check to be sure.

Supporting older bookmarks would make this change much more difficult. Primarily because of iOS and Browser platforms, where bookmarks are the most important. We can't simply check if file exist there. And bookmarks there never been a file path.
BCL implementation of bookmarks is the least important.

So, we are planning to break all apps that were previously using the API, right?

@kekekeks pushed couple of changes.

All bookmarks are now prefixed with "ava."

All bookmarks now have bookmark version information prefixed as well, i.e. "ava.v1.bcl"

If bookmark doesn't have a prefix, attempt to load it as if it's an old format bookmarks (i.e. 11.0, 11.1 state)

So should be better now.

If we will ever need to extend bookmarks format, i.e. add extra information or make header bigger or dynamic, v2 can be added without breaking v1.

avaloniaui-bot · 2024-07-16T21:36:10Z

You can test this PR using the following package version. 11.2.999-cibuild0050186-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

maxkatz6 added 6 commits June 19, 2024 16:56

Set isDirectory:true explicitly to help [NSURL fileURLWithPath] method

130552c

Might solve some rare/random issues with initial directory not being applied

Fix dialogs page incorrectly setting parent folder

8a6a8b2

Move SecurityScopedStream out of iOS project and share it with macOS …

0b04775

…project

Refactor BclStorageItem to be more reusable across platforms

bb9d653

[Breaking] Set BclStorageItem.CanBookmark to false, as it never was s…

ebd9e58

…upposed to be true. Plain BCL doesn't provide files bookmarking.

Reimplement storage provider support on macOS, support (optional) san…

15cb712

…dboxing

maxkatz6 added enhancement os-macos breaking-change labels Jun 23, 2024

maxkatz6 added 2 commits June 22, 2024 18:00

Fix build

37b18c8

Fix AppSandboxEnabled=false usage

fcac5d7

Merge remote-tracking branch 'origin/master' into macos-bookmarks

5c6fd66

maxkatz6 added 2 commits July 12, 2024 18:17

Merge branch 'master' into macos-bookmarks

3a13185

Re-enable BCL bookmarks, keep them base64

7de3a88

Fix nullable error

74b303d

Prefix all bookmarks with a platform key

52a2a4d

Fix devtools breaking sandboxed app

375a9b3

maxkatz6 added 2 commits July 15, 2024 21:15

Try to read errors after saving bookmark

f22a32b

Don't crash sample app if has no access

f1d21a4

maxkatz6 added 3 commits July 15, 2024 21:16

Add internal IStorageItemWithFileSystemInfo abstraction

eaa6c62

Log information if OpenSecurityScope returned false

c6ac64d

Fix build

47c3e3c

maxkatz6 requested a review from kekekeks July 16, 2024 06:06

kekekeks reviewed Jul 16, 2024

View reviewed changes

src/Avalonia.Base/Platform/Storage/IStorageBookmarkItem.cs Show resolved Hide resolved

kekekeks reviewed Jul 16, 2024

View reviewed changes

maxkatz6 added 2 commits July 16, 2024 13:05

Prefix bookmarks with "ava.v1."

838b390

Support opening old-style bookmarks to avoid breaking changes

3ac1e32

kekekeks approved these changes Jul 18, 2024

View reviewed changes

Merge branch 'master' into macos-bookmarks

c3c564e

maxkatz6 merged commit 32c2f08 into master Jul 19, 2024
2 checks passed

maxkatz6 deleted the macos-bookmarks branch July 19, 2024 01:03

maxkatz6 added the feature label Aug 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MacOS sandboxing feature #16090

MacOS sandboxing feature #16090

maxkatz6 commented Jun 23, 2024 •

edited

Loading

avaloniaui-bot commented Jun 23, 2024

kekekeks commented Jun 24, 2024

kekekeks commented Jun 24, 2024

avaloniaui-bot commented Jul 9, 2024

maxkatz6 commented Jul 13, 2024

avaloniaui-bot commented Jul 13, 2024

avaloniaui-bot commented Jul 13, 2024

kekekeks commented Jul 13, 2024

maxkatz6 commented Jul 15, 2024

avaloniaui-bot commented Jul 16, 2024

avaloniaui-bot commented Jul 16, 2024

avaloniaui-bot commented Jul 16, 2024

kekekeks Jul 16, 2024 •

edited

Loading

maxkatz6 Jul 16, 2024

kekekeks commented Jul 16, 2024

maxkatz6 commented Jul 16, 2024

kekekeks Jul 16, 2024

maxkatz6 Jul 16, 2024 •

edited

Loading

kekekeks Jul 16, 2024

maxkatz6 Jul 16, 2024

maxkatz6 Jul 16, 2024

avaloniaui-bot commented Jul 16, 2024

MacOS sandboxing feature #16090

MacOS sandboxing feature #16090

Conversation

maxkatz6 commented Jun 23, 2024 • edited Loading

What does the pull request do?

How to test

Breaking changes

Fixed issues

avaloniaui-bot commented Jun 23, 2024

kekekeks commented Jun 24, 2024

kekekeks commented Jun 24, 2024

avaloniaui-bot commented Jul 9, 2024

maxkatz6 commented Jul 13, 2024

avaloniaui-bot commented Jul 13, 2024

avaloniaui-bot commented Jul 13, 2024

kekekeks commented Jul 13, 2024

maxkatz6 commented Jul 15, 2024

avaloniaui-bot commented Jul 16, 2024

avaloniaui-bot commented Jul 16, 2024

avaloniaui-bot commented Jul 16, 2024

kekekeks Jul 16, 2024 • edited Loading

Choose a reason for hiding this comment

maxkatz6 Jul 16, 2024

Choose a reason for hiding this comment

kekekeks commented Jul 16, 2024

maxkatz6 commented Jul 16, 2024

kekekeks Jul 16, 2024

Choose a reason for hiding this comment

maxkatz6 Jul 16, 2024 • edited Loading

Choose a reason for hiding this comment

kekekeks Jul 16, 2024

Choose a reason for hiding this comment

maxkatz6 Jul 16, 2024

Choose a reason for hiding this comment

maxkatz6 Jul 16, 2024

Choose a reason for hiding this comment

avaloniaui-bot commented Jul 16, 2024

maxkatz6 commented Jun 23, 2024 •

edited

Loading

kekekeks Jul 16, 2024 •

edited

Loading

maxkatz6 Jul 16, 2024 •

edited

Loading