Safely Exchanging Data between Webview and Side Car

[joonipea]

Hi all, I'm working on a project where I'm passing files to a Node.js/Puppeteer sidecar from a Tauri Webview and receiving periodic updates via STDIN/O. The general flow looks something like this:

Tauri Webview

// example of receiving variable from sidecar
comm.stdout.on("data", (line) => {
  console.log(`command stdout: "${line}"`);
  if (line.includes("uniquePuppeteerID~!@")) {
    handleIssueAssignment(line);
    return;
  }
  additionalLogs = autoRes + "<br>" + additionalLogs;
  autoRes = line;
});
// example of logging errors from sidecar
let sidecarErr = 0
comm.stderr.on("data", (line) => {
  console.log(`command stderr: "${line}"`);
  sidecarErr++;
  errorLogs = errorLogs + "<br>" + line;
});

// tell the process to close and cleanup puppeteer process
getCurrentWindow().listen('tauri://close-requested', async ()=> {
      childBinary.write("close");
      await getCurrentWindow().destroy();
    })

Puppeteer Sidecar

// example of sending a variable back to webview
console.log("uniquePuppeteerID~!@VariableIdentifier~!@" + JSON.stringify(variable))
// handling close from webview
process.stdin.on('data', async (data) => {
  if (data.toString() == "close") {
    await browser.close();
    process.exit(0);
  }
})

This works great, but I'm thinking about a couple things:

1. How hard would it be to send a "close" to the sidecar's STDIN from somewhere other than webview? Is this a potential security risk?
2. Would it be safer and cleaner to use something like WebSocket to handle this sort of communication?
3. Alternatively is there a standard Tauri way to communicate between a sidecar and WebView?
4. Could I possibly eliminate the need for a sidecar? Have people found success in puppeteer alternatives for Rust?

Thanks!