fix(windows): 提权运行时打通跨完整性级别的进程通信

提权（High IL）运行时，Windows 静默丢弃来自低完整性（Medium
IL）来源的管道连接与窗口消息，致浏览器接管、拖链建任务、
单实例参数转发全部失效。

加固：命名管道 SDDL 打低完整性标签；单实例互斥体改用跨完整性
SECURITY_ATTRIBUTES；WM_COPYDATA 与拖放消息经 UIPI 显式放行。

Author: zerx-lab

native/hub/src/native_messaging.rs

@@ -172,6 +172,117 @@ mod server {
         }
     }
 
+    /// Windows pipe security: grant Everyone read/write and stamp a Low
+    /// mandatory integrity label so a Medium-IL `fluxdown_nmh.exe` (spawned by
+    /// the browser) can connect even when FluxDown runs elevated (High IL).
+    /// Without it the pipe inherits the creator's High IL and the no-write-up
+    /// rule silently rejects the relay — browser interception dies until the
+    /// app next runs unelevated.
+    mod pipe_security {
+        use std::ffi::c_void;
+        use std::io;
+
+        #[repr(C)]
+        struct SecurityAttributes {
+            n_length: u32,
+            lp_security_descriptor: *mut c_void,
+            b_inherit_handle: i32,
+        }
+
+        #[link(name = "advapi32")]
+        unsafe extern "system" {
+            fn ConvertStringSecurityDescriptorToSecurityDescriptorW(
+                string_security_descriptor: *const u16,
+                string_sddl_revision: u32,
+                security_descriptor: *mut *mut c_void,
+                security_descriptor_size: *mut u32,
+            ) -> i32;
+        }
+
+        #[link(name = "kernel32")]
+        unsafe extern "system" {
+            fn LocalFree(hmem: *mut c_void) -> *mut c_void;
+        }
+
+        /// Owns the security descriptor allocated by the SDDL conversion plus
+        /// the `SECURITY_ATTRIBUTES` pointing at it; frees it on drop. Never
+        /// held across an `.await` (built and dropped inside the synchronous
+        /// `create_instance`), so the raw pointer needs no `Send`.
+        pub struct PipeSecurity {
+            attrs: SecurityAttributes,
+        }
+
+        impl PipeSecurity {
+            /// Build the descriptor, or error if the SDDL conversion fails.
+            pub fn new() -> io::Result<Self> {
+                // D: Everyone (WD) generic read+write. S: Low mandatory label,
+                // no-write-up (equal/higher IL subjects may still write).
+                let sddl: Vec<u16> = "D:(A;;GRGW;;;WD)S:(ML;;NW;;;LW)"
+                    .encode_utf16()
+                    .chain(std::iter::once(0))
+                    .collect();
+                let mut psd: *mut c_void = std::ptr::null_mut();
+                // SAFETY: `sddl` is a valid NUL-terminated UTF-16 string; on
+                // success the call allocates `psd`, freed in `Drop`. Revision
+                // 1 == SDDL_REVISION_1.
+                let ok = unsafe {
+                    ConvertStringSecurityDescriptorToSecurityDescriptorW(
+                        sddl.as_ptr(),
+                        1,
+                        &mut psd,
+                        std::ptr::null_mut(),
+                    )
+                };
+                if ok == 0 {
+                    return Err(io::Error::last_os_error());
+                }
+                Ok(Self {
+                    attrs: SecurityAttributes {
+                        n_length: std::mem::size_of::<SecurityAttributes>() as u32,
+                        lp_security_descriptor: psd,
+                        b_inherit_handle: 0,
+                    },
+                })
+            }
+
+            /// Pointer to the `SECURITY_ATTRIBUTES`, valid while `self` lives.
+            pub fn as_ptr(&self) -> *mut c_void {
+                (&raw const self.attrs).cast::<c_void>().cast_mut()
+            }
+        }
+
+        impl Drop for PipeSecurity {
+            fn drop(&mut self) {
+                if !self.attrs.lp_security_descriptor.is_null() {
+                    // SAFETY: descriptor was allocated by the SDDL conversion.
+                    unsafe { LocalFree(self.attrs.lp_security_descriptor) };
+                }
+            }
+        }
+    }
+
+    /// Create one pipe server instance with a hardened security descriptor
+    /// (Everyone R/W + Low integrity label) so a Medium-IL NMH relay can
+    /// connect even when FluxDown runs elevated. Falls back to default security
+    /// if the descriptor cannot be built, never breaking the unelevated path.
+    fn create_instance(
+        first: bool,
+    ) -> std::io::Result<tokio::net::windows::named_pipe::NamedPipeServer> {
+        let mut options = ServerOptions::new();
+        options.first_pipe_instance(first);
+        match pipe_security::PipeSecurity::new() {
+            // SAFETY: `sec` and its descriptor outlive this create call, which
+            // copies the SECURITY_ATTRIBUTES into the pipe synchronously.
+            Ok(sec) => unsafe {
+                options.create_with_security_attributes_raw(PIPE_NAME, sec.as_ptr())
+            },
+            Err(e) => {
+                log_info!("[nmh-pipe] pipe security unavailable, using default: {}", e);
+                options.create(PIPE_NAME)
+            }
+        }
+    }
+
     /// Spawn the Named Pipe server, feeding download requests into `tx`.
     /// The receiving end is owned by `download_actor` and shared with the
     /// local HTTP takeover server so both transports converge on one channel.
@@ -180,10 +291,7 @@ mod server {
             log_info!("[nmh-pipe] starting Named Pipe server at {}", PIPE_NAME);
 
             // Create the first server instance before entering the loop.
-            let mut server = match ServerOptions::new()
-                .first_pipe_instance(true)
-                .create(PIPE_NAME)
-            {
+            let mut server = match create_instance(true) {
                 Ok(s) => s,
                 Err(e) => {
                     log_info!("[nmh-pipe] failed to create pipe server: {}", e);
@@ -204,7 +312,7 @@ mod server {
 
                 // Create the next server instance to accept the next client
                 // while we handle the current one.
-                let next_server = match ServerOptions::new().create(PIPE_NAME) {
+                let next_server = match create_instance(false) {
                     Ok(s) => s,
                     Err(e) => {
                         log_info!("[nmh-pipe] failed to create next pipe instance: {}", e);

windows/runner/floating_ball_drop_target.cpp

@@ -21,6 +21,16 @@ HRESULT FloatingBallDropTarget::RegisterOn(HWND hwnd) {
   HRESULT hr = ::RegisterDragDrop(hwnd, this);
   if (SUCCEEDED(hr)) {
     registered_hwnd_ = hwnd;
+    // UIPI hardening: when FluxDown runs elevated (High IL), Windows silently
+    // filters drag-drop window messages posted by lower-integrity sources
+    // (Explorer / browser at Medium IL), so OLE drops onto the ball never
+    // fire. Explicitly allow them for this HWND. Best-effort; failures and
+    // pre-Win7 systems are harmless (equal-IL drops already work).
+    static constexpr UINT kWmCopyGlobalData = 0x0049;  // undocumented, no macro
+    ::ChangeWindowMessageFilterEx(hwnd, WM_DROPFILES, MSGFLT_ALLOW, nullptr);
+    ::ChangeWindowMessageFilterEx(hwnd, WM_COPYDATA, MSGFLT_ALLOW, nullptr);
+    ::ChangeWindowMessageFilterEx(hwnd, kWmCopyGlobalData, MSGFLT_ALLOW,
+                                  nullptr);
   }
   return hr;
 }

windows/runner/flutter_window.cpp

@@ -116,6 +116,14 @@ bool FlutterWindow::OnCreate() {
   // window is shown. It is a no-op if the first frame hasn't completed yet.
   flutter_controller_->ForceRedraw();
 
+  // UIPI hardening: allow a lower-integrity (Medium IL) second instance to
+  // deliver its command-line args via WM_COPYDATA when this instance runs
+  // elevated (High IL). Pairs with the single-instance mutex hardening in
+  // main.cpp; without it the forwarded URL/torrent is silently dropped.
+  if (HWND handle = GetHandle()) {
+    ::ChangeWindowMessageFilterEx(handle, WM_COPYDATA, MSGFLT_ALLOW, nullptr);
+  }
+
   return true;
 }
 

windows/runner/main.cpp

@@ -2,6 +2,7 @@
 #include <flutter/flutter_view_controller.h>
 #include <windows.h>
 #include <dbghelp.h>
+#include <sddl.h>
 
 #include <iostream>
 #include <sstream>
@@ -11,6 +12,7 @@
 #include "utils.h"
 
 #pragma comment(lib, "dbghelp.lib")
+#pragma comment(lib, "advapi32.lib")
 
 static LONG WINAPI FluxDownCrashHandler(EXCEPTION_POINTERS* ep) {
   std::ostringstream oss;
@@ -75,6 +77,31 @@ static bool SendArgsToExistingInstance(const std::vector<std::string>& args) {
   return true;
 }
 
+// Build a SECURITY_ATTRIBUTES that grants Everyone full access to the
+// single-instance mutex and stamps it with a Low mandatory integrity label
+// (no-write-up). Without this, a Medium-IL second instance cannot open the
+// mutex a High-IL (elevated) first instance created: CreateMutex then returns
+// ACCESS_DENIED instead of ERROR_ALREADY_EXISTS and the app double-launches.
+// Returns nullptr (default security) on failure; on success the caller must
+// LocalFree(*out_sd) after CreateMutex.
+static LPSECURITY_ATTRIBUTES BuildCrossIntegritySA(SECURITY_ATTRIBUTES* sa,
+                                                   PSECURITY_DESCRIPTOR* out_sd) {
+  *out_sd = nullptr;
+  PSECURITY_DESCRIPTOR sd = nullptr;
+  // D: Everyone (WD) mutex all-access (0x1F0001). S: Low mandatory label,
+  // no-write-up so equal/higher IL subjects may still open it.
+  if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(
+          L"D:(A;;0x1F0001;;;WD)S:(ML;;NW;;;LW)", SDDL_REVISION_1, &sd,
+          nullptr)) {
+    return nullptr;
+  }
+  sa->nLength = sizeof(*sa);
+  sa->lpSecurityDescriptor = sd;
+  sa->bInheritHandle = FALSE;
+  *out_sd = sd;
+  return sa;
+}
+
 int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
                       _In_ wchar_t *command_line, _In_ int show_command) {
   // Collect command-line arguments early (needed for both paths).
@@ -85,8 +112,13 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
   // --- Single-instance check ---
   // Try to create a named mutex. If it already exists, another instance
   // is running -- forward our args to it and exit.
-  HANDLE mutex = ::CreateMutex(nullptr, FALSE, kMutexName);
-  if (mutex && ::GetLastError() == ERROR_ALREADY_EXISTS) {
+  SECURITY_ATTRIBUTES mutex_sa = {};
+  PSECURITY_DESCRIPTOR mutex_sd = nullptr;
+  LPSECURITY_ATTRIBUTES mutex_psa = BuildCrossIntegritySA(&mutex_sa, &mutex_sd);
+  HANDLE mutex = ::CreateMutex(mutex_psa, FALSE, kMutexName);
+  const DWORD mutex_err = ::GetLastError();  // capture before LocalFree
+  if (mutex_sd) ::LocalFree(mutex_sd);
+  if (mutex && mutex_err == ERROR_ALREADY_EXISTS) {
     SendArgsToExistingInstance(command_line_arguments);
     ::CloseHandle(mutex);
     return EXIT_SUCCESS;