{"record":{"id":"64d34e27c5ddabe3","repo":"tauri-apps/tauri","slug":"tauri-isolation-pattern-only-supports-relative-o","errorCode":null,"errorMessage":"Tauri \"Isolation\" Pattern only supports relative or absolute (`/`) paths.","messagePattern":"Tauri \"Isolation\" Pattern only supports relative or absolute \\(`/`\\) paths\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri-utils/src/html.rs","lineNumber":272,"sourceCode":"/// is secure.\npub fn inline_isolation(document: &NodeRef, dir: &Path) {\n  for script in document\n    .select(\"script[src]\")\n    .expect(\"unable to parse document for scripts\")\n  {\n    let src = {\n      let attributes = script.attributes.borrow();\n      attributes\n        .get(LocalName::from(\"src\"))\n        .expect(\"script with src attribute has no src value\")\n        .to_string()\n    };\n\n    let mut path = PathBuf::from(src);\n    if path.has_root() {\n      path = path\n        .strip_prefix(\"/\")\n        .expect(\"Tauri \\\"Isolation\\\" Pattern only supports relative or absolute (`/`) paths.\")\n        .into();\n    }\n\n    let file = std::fs::read_to_string(dir.join(path)).expect(\"unable to find isolation file\");\n    script.as_node().append(NodeRef::new_text(file));\n\n    let mut attributes = script.attributes.borrow_mut();\n    attributes.remove(LocalName::from(\"src\"));\n  }\n}\n\n// TODO: Verify this, this is not found in the HTML spec, see https://github.com/tauri-apps/tauri/pull/14265#discussion_r2415396842\n/// Normalize line endings in script content to match what the browser uses for CSP hashing.\n///\n/// According to the HTML spec, browsers normalize:\n/// - `\\r\\n` → `\\n`\n/// - `\\r`   → `\\n`\npub fn normalize_script_for_csp(input: &[u8]) -> Vec<u8> {","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/tauri-apps/tauri/blob/52e4b6e71d8632a7e648f866c442e287ecddee34/crates/tauri-utils/src/html.rs#L254-L290","documentation":"Thrown while Tauri processes the index.html used by the Isolation Pattern. Every <script src=...> in that file is resolved against the app's dist directory: rooted paths are normalized by stripping the leading '/'. The expect fires when strip_prefix(\"/\") fails, i.e. the path is rooted but does not start with '/': Windows drive letters (C:\\...) or UNC paths (\\\\server\\share\\...).","triggerScenarios":"Enabling the isolation pattern (app.security.pattern.isolation) and putting a Windows absolute or UNC path in a script src of the isolation index.html, e.g. <script src=\"C:\\js\\isolate.js\"> or src=\"\\\\nas\\share\\isolate.js\">, then building/running on Windows. A Unix-style '/isolation.js' passes because stripping '/' succeeds.","commonSituations":"Developers on Windows authoring the isolation template with local absolute paths; Windows CI runners; cross-platform projects where a teammate committed a drive-letter path.","solutions":["Change the script src in the isolation HTML to a path relative to the frontend dist directory (src=\"isolation.js\" or src=\"assets/isolation.js\").","If it must be absolute, use a URL-style path starting with a single '/' (src=\"/isolation.js\").","Never use drive letters (C:\\) or UNC (\\\\server\\share) in script src attributes of the isolation index.html."],"exampleFix":"<!-- before -->\n<script src=\"C:\\www\\isolate.js\"></script>\n\n<!-- after -->\n<script src=\"isolate.js\"></script>","handlingStrategy":"validation","validationCode":"// before building, lint the isolation index.html script srcs\nfn is_supported_isolation_src(src: &str) -> bool {\n    let b = src.as_bytes();\n    !(src.starts_with(\"\\\\\\\\\") || (b.len() >= 2 && b[1] == b':'))\n}\nfor src in collect_script_srcs(\"isolation/index.html\") {\n    assert!(is_supported_isolation_src(src), \"unsupported script src: {src}\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep script src in the isolation HTML relative to the dist directory.","Add a CI check that rejects drive-letter or UNC paths in the isolation template.","Treat script src values as URLs, not filesystem paths."],"tags":["tauri","isolation-pattern","windows","path","html"],"backgroundTag":"windows-absolute-path-error","analyzedSha":"52e4b6e71d8632a7e648f866c442e287ecddee34","analyzedAt":"2026-08-20T13:59:20.734Z","contentChangedAt":"2026-08-20T13:59:20.734Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}