Update SECURITY.md

Co-authored-by: leaanthony <leaanthony@users.noreply.github.com>

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x.x   | :white_check_mark: |
+| 3.0.x-alpha   | :x:                |
+
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in our project, we encourage you to let us know right away. 
+We will investigate all legitimate reports and do our best to quickly fix the problem. 
+
+Before reporting though, please review our security policy below.
+
+### How to Report
+
+To report a security vulnerability, please use GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) feature. If possible, please include as much information as possible. 
+This may include steps to reproduce, impact of the vulnerability, and anything else you believe would help us understand the problem.
+**Please do not include any sensitive or personal information in your report**.
+
+### What to Expect
+
+When you report a vulnerability, here's what you can expect:
+
+- **Acknowledgement**: We will acknowledge your email within 48 hours, and you'll receive a more detailed response to your email within 72 hours indicating the next steps in handling your report.
+
+- **Updates**: After the initial reply to your report, our team will keep you informed of the progress being made towards a fix and full announcement. These updates will be sent at least once a week.
+
+- **Confidentiality**: We will maintain strict confidentiality of your report until the security issue is resolved.
+
+- **Issue Resolution**: If the issue is confirmed, we will release a patch as soon as possible depending on complexity of the fix.
+
+- **Recognition**: We recognize and appreciate every individual who helps us identify and fix vulnerabilities in our project. While we do not currently have a bounty program, we would be happy to publicly acknowledge your responsible disclosure.
+
+We strive to make Wails safe for everyone, and we greatly appreciate the assistance of security researchers and users in helping us identify and fix vulnerabilities. Thank you for your contribution to the security of this project.

v2/cmd/wails/build.go

@@ -108,7 +108,7 @@ func buildApplication(f *flags.Build) error {
 		{"Tags", "[" + strings.Join(f.GetTags(), ",") + "]"},
 		{"Race Detector", bool2Str(f.RaceDetector)},
 	}...)
-	if len(buildOptions.OutputFile) > 0 && len(f.GetTargets()) == 1 {
+	if len(buildOptions.OutputFile) > 0 && f.GetTargets().Length() == 1 {
 		tableData = append(tableData, []string{"Output File", f.OutputFilename})
 	}
 	pterm.DefaultSection.Println("Build Options")
@@ -145,11 +145,16 @@ func buildApplication(f *flags.Build) error {
 
 	// Allows cancelling the build after the first error. It would be nice if targets.Each would support funcs
 	// returning an error.
+	var targetErr error
 	targets := f.GetTargets()
-	for _, target := range targets {
-		if !validPlatformArch.Contains(target.Platform) {
-			buildOptions.Logger.Println("platform '%s' is not supported - skipping. Supported platforms: %s", target.Platform, validPlatformArch.Join(","))
-			continue
+	targets.Each(func(platform string) {
+		if targetErr != nil {
+			return
+		}
+
+		if !validPlatformArch.Contains(platform) {
+			buildOptions.Logger.Println("platform '%s' is not supported - skipping. Supported platforms: %s", platform, validPlatformArch.Join(","))
+			return
 		}
 
 		desiredFilename := projectOptions.OutputFilename
@@ -158,13 +163,17 @@ func buildApplication(f *flags.Build) error {
 		}
 		desiredFilename = strings.TrimSuffix(desiredFilename, ".exe")
 
-		buildOptions.Platform = target.Platform
-		buildOptions.Arch = target.Arch
-
+		// Calculate platform and arch
+		platformSplit := strings.Split(platform, "/")
+		buildOptions.Platform = platformSplit[0]
+		buildOptions.Arch = f.GetDefaultArch()
+		if len(platformSplit) > 1 {
+			buildOptions.Arch = platformSplit[1]
+		}
 		banner := "Building target: " + buildOptions.Platform + "/" + buildOptions.Arch
 		pterm.DefaultSection.Println(banner)
 
-		if f.Upx && target.String() == "darwin/universal" {
+		if f.Upx && platform == "darwin/universal" {
 			pterm.Warning.Println("Warning: compress flag unsupported for universal binaries. Ignoring.")
 			f.Upx = false
 		}
@@ -173,19 +182,22 @@ func buildApplication(f *flags.Build) error {
 		case "linux":
 			if runtime.GOOS != "linux" {
 				pterm.Warning.Println("Crosscompiling to Linux not currently supported.")
-				continue
+				return
 			}
 		case "darwin":
 			if runtime.GOOS != "darwin" {
 				pterm.Warning.Println("Crosscompiling to Mac not currently supported.")
-				continue
+				return
 			}
-			if targets.MacTargetsCount() == 2 {
+			macTargets := targets.Filter(func(platform string) bool {
+				return strings.HasPrefix(platform, "darwin")
+			})
+			if macTargets.Length() == 2 {
 				buildOptions.BundleName = fmt.Sprintf("%s-%s.app", desiredFilename, buildOptions.Arch)
 			}
 		}
 
-		if len(targets) > 1 {
+		if targets.Length() > 1 {
 			// target filename
 			switch buildOptions.Platform {
 			case "windows":
@@ -207,27 +219,32 @@ func buildApplication(f *flags.Build) error {
 			pterm.Warning.Println("obfuscated flag overrides skipbindings flag.")
 			buildOptions.SkipBindings = false
 		}
-	}
 
-	if !f.DryRun {
-		// Start Time
-		start := time.Now()
+		if !f.DryRun {
+			// Start Time
+			start := time.Now()
 
-		compiledBinary, err := build.Build(buildOptions)
-		if err != nil {
-			pterm.Error.Println(err.Error())
-			return err
+			compiledBinary, err := build.Build(buildOptions)
+			if err != nil {
+				pterm.Error.Println(err.Error())
+				targetErr = err
+				return
+			}
+
+			buildOptions.IgnoreFrontend = true
+			buildOptions.CleanBinDirectory = false
+
+			// Output stats
+			buildOptions.Logger.Println(fmt.Sprintf("Built '%s' in %s.\n", compiledBinary, time.Since(start).Round(time.Millisecond).String()))
+
+			outputBinaries[buildOptions.Platform+"/"+buildOptions.Arch] = compiledBinary
+		} else {
+			pterm.Info.Println("Dry run: skipped build.")
 		}
+	})
 
-		buildOptions.IgnoreFrontend = true
-		buildOptions.CleanBinDirectory = false
-
-		// Output stats
-		buildOptions.Logger.Println(fmt.Sprintf("Built '%s' in %s.\n", compiledBinary, time.Since(start).Round(time.Millisecond).String()))
-
-		outputBinaries[buildOptions.Platform+"/"+buildOptions.Arch] = compiledBinary
-	} else {
-		pterm.Info.Println("Dry run: skipped build.")
+	if targetErr != nil {
+		return targetErr
 	}
 
 	if f.DryRun {

v2/cmd/wails/flags/build.go

@@ -2,10 +2,13 @@ package flags
 
 import (
 	"fmt"
+	"os"
 	"os/exec"
+	"runtime"
 	"strings"
 
 	"github.com/leaanthony/slicer"
+	"github.com/wailsapp/wails/v2/internal/system"
 	"github.com/wailsapp/wails/v2/pkg/commands/build"
 	"github.com/wailsapp/wails/v2/pkg/commands/buildtags"
 )
@@ -46,15 +49,29 @@ type Build struct {
 	compilerPath  string
 	userTags      []string
 	wv2rtstrategy string // WebView2 runtime strategy
+	defaultArch   string // Default architecture
 }
 
 func (b *Build) Default() *Build {
-	target := defaultTarget()
+	defaultPlatform := os.Getenv("GOOS")
+	if defaultPlatform == "" {
+		defaultPlatform = runtime.GOOS
+	}
+	defaultArch := os.Getenv("GOARCH")
+	if defaultArch == "" {
+		if system.IsAppleSilicon {
+			defaultArch = "arm64"
+		} else {
+			defaultArch = runtime.GOARCH
+		}
+	}
 
 	result := &Build{
-		Platform:   target.Platform,
+		Platform:   defaultPlatform + "/" + defaultArch,
 		WebView2:   "download",
 		GarbleArgs: "-literals -tiny -seed=random",
+
+		defaultArch: defaultArch,
 	}
 	result.BuildCommon = result.BuildCommon.Default()
 	return result
@@ -71,8 +88,11 @@ func (b *Build) GetWebView2Strategy() string {
 	return b.wv2rtstrategy
 }
 
-func (b *Build) GetTargets() TargetsCollection {
-	return parseTargets(b.Platform)
+func (b *Build) GetTargets() *slicer.StringSlicer {
+	var targets slicer.StringSlicer
+	targets.AddSlice(strings.Split(b.Platform, ","))
+	targets.Deduplicate()
+	return &targets
 }
 
 func (b *Build) GetCompilerPath() string {
@@ -124,6 +144,10 @@ func (b *Build) GetBuildModeAsString() string {
 	return "production"
 }
 
+func (b *Build) GetDefaultArch() string {
+	return b.defaultArch
+}
+
 /*
 	_, _ = fmt.Fprintf(w, "Frontend Directory: \t%s\n", projectOptions.GetFrontendDir())
 	_, _ = fmt.Fprintf(w, "Obfuscated: \t%t\n", buildOptions.Obfuscated)

v2/cmd/wails/flags/common.go

@@ -1,103 +1,5 @@
 package flags
 
-import (
-	"fmt"
-	"os"
-	"runtime"
-	"strings"
-
-	"github.com/leaanthony/slicer"
-	"github.com/pterm/pterm"
-	"github.com/wailsapp/wails/v2/internal/system"
-)
-
 type Common struct {
 	NoColour bool `description:"Disable colour in output"`
 }
-
-type Target struct {
-	Platform string
-	Arch     string
-}
-
-func defaultTarget() Target {
-	defaultPlatform := os.Getenv("GOOS")
-	if defaultPlatform == "" {
-		defaultPlatform = runtime.GOOS
-	}
-	defaultArch := os.Getenv("GOARCH")
-	if defaultArch == "" {
-		if system.IsAppleSilicon {
-			defaultArch = "arm64"
-		} else {
-			defaultArch = runtime.GOARCH
-		}
-	}
-
-	return Target{
-		Platform: defaultPlatform,
-		Arch:     defaultArch,
-	}
-}
-
-type TargetsCollection []Target
-
-func (c TargetsCollection) MacTargetsCount() int {
-	count := 0
-
-	for _, t := range c {
-		if strings.HasPrefix(t.Platform, "darwin") {
-			count++
-		}
-	}
-
-	return count
-}
-
-func (t Target) String() string {
-	if t.Arch != "" {
-		return fmt.Sprintf("%s/%s", t.Platform, t.Arch)
-	}
-
-	return t.Platform
-}
-
-func parseTargets(platform string) TargetsCollection {
-	allowedPlatforms := map[string]bool{
-		"windows": true,
-		"linux":   true,
-		"darwin":  true,
-	}
-
-	if !allowedPlatforms[platform] {
-		pterm.Error.Println("platform argument must be one of 'windows', 'linux', or 'darwin'")
-		os.Exit(1)
-	}
-
-	var result []Target
-	var targets slicer.StringSlicer
-
-	targets.AddSlice(strings.Split(platform, ","))
-	targets.Deduplicate()
-
-	targets.Each(func(platform string) {
-		target := Target{
-			Platform: "",
-			Arch:     "",
-		}
-
-		platformSplit := strings.Split(platform, "/")
-
-		target.Platform = platformSplit[0]
-
-		if len(platformSplit) > 1 {
-			target.Arch = platformSplit[1]
-		} else {
-			target.Arch = defaultTarget().Arch
-		}
-
-		result = append(result, target)
-	})
-
-	return result
-}

v2/cmd/wails/flags/dev.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"runtime"
 
 	"github.com/samber/lo"
 	"github.com/wailsapp/wails/v2/internal/project"
@@ -16,7 +17,6 @@ type Dev struct {
 	BuildCommon
 
 	AssetDir             string `flag:"assetdir" description:"Serve assets from the given directory instead of using the provided asset FS"`
-	Platform             string `flag:"platform" description:"Platform to target"`
 	Extensions           string `flag:"e" description:"Extensions to trigger rebuilds (comma separated) eg go"`
 	ReloadDirs           string `flag:"reloaddirs" description:"Additional directories to trigger reloads (comma separated)"`
 	Browser              bool   `flag:"browser" description:"Open the application in a browser"`
@@ -38,13 +38,10 @@ type Dev struct {
 }
 
 func (*Dev) Default() *Dev {
-	target := defaultTarget()
 	result := &Dev{
 		Extensions: "go",
 		Debounce:   100,
-		Platform:   target.Platform,
 	}
-
 	result.BuildCommon = result.BuildCommon.Default()
 	return result
 }
@@ -119,15 +116,13 @@ func (d *Dev) loadAndMergeProjectConfig() error {
 
 // GenerateBuildOptions creates a build.Options using the flags
 func (d *Dev) GenerateBuildOptions() *build.Options {
-	targets := parseTargets(d.Platform)
-
 	result := &build.Options{
 		OutputType:     "dev",
 		Mode:           build.Dev,
 		Devtools:       true,
-		Arch:           targets[0].Arch,
+		Arch:           runtime.GOARCH,
 		Pack:           true,
-		Platform:       targets[0].Platform,
+		Platform:       runtime.GOOS,
 		LDFlags:        d.LdFlags,
 		Compiler:       d.Compiler,
 		ForceBuild:     d.ForceBuild,

v2/cmd/wails/internal/dev/dev.go

@@ -268,16 +268,6 @@ func runFrontendDevWatcherCommand(frontendDirectory string, devCommand string, d
 	}, viteServerURL, viteVersion, nil
 }
 
-func isWsl() bool {
-	version, err := os.ReadFile("/proc/version")
-
-	if err != nil {
-		return false
-	}
-
-	return strings.Contains(strings.ToLower(string(version)), "wsl")
-}
-
 // restartApp does the actual rebuilding of the application when files change
 func restartApp(buildOptions *build.Options, debugBinaryProcess *process.Process, f *flags.Dev, exitCodeChannel chan int, legacyUseDevServerInsteadofCustomScheme bool) (*process.Process, string, error) {
 	appBinary, err := build.Build(buildOptions)
@@ -316,12 +306,6 @@ func restartApp(buildOptions *build.Options, debugBinaryProcess *process.Process
 	os.Setenv("devserver", f.DevServer)
 	os.Setenv("frontenddevserverurl", f.FrontendDevServerURL)
 
-	if buildOptions.IsWindowsTargetPlatform() && isWsl() {
-		// In the case of building a Windows executable under WSL, we need to specify this variable with a list of
-		// variables that will be passed through
-		os.Setenv("WSLENV", "loglevel/w:frontenddevserverurl/w:devserver/w:assetdir/w")
-	}
-
 	// Start up new binary with correct args
 	newProcess := process.NewProcess(appBinary, args...)
 	err = newProcess.Start(exitCodeChannel)

v2/pkg/commands/build/build.go

@@ -71,10 +71,6 @@ type Options struct {
 	SkipBindings      bool                 // Skip binding generation
 }
 
-func (o *Options) IsWindowsTargetPlatform() bool {
-	return strings.Contains(strings.ToLower(o.Platform), "windows")
-}
-
 // Build the project!
 func Build(options *Options) (string, error) {
 	// Extract logger

website/src/pages/changelog.mdx

@@ -17,7 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## v2.8.0 - 2024-02-08
 
 ### Added
-- Added option to specify platform for dev command. Thanks to [@pylotlight](https://github.com/pylotlight) for the fix ([#3117](https://github.com/wailsapp/wails/pull/3117)). Based on the work of [@evsign](https://github.com/evsign) in [Draft PR](https://github.com/wailsapp/wails/pull/2724).
+
 - Added windows options supports `DisablePinchZoom` configuration. Added by @tuuzed in [PR](https://github.com/wailsapp/wails/pull/3115)
 - Add Apple Silicon hardware detection to `wails doctor`. Changed by @almas1992 in [PR](https://github.com/wailsapp/wails/pull/3129)
 - Remove quarantine attribute on macOS binaries. Changed by @leaanthony in [PR](https://github.com/wailsapp/wails/pull/3118)