question: sandbox for following symlinks
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- c
- Domain
- operating-systems
Research direction
Review the assumptions around merged issue #224, then trace uvwasi's symlink and sandbox path handling while comparing the listed cases with wasmtime. Done means establishing whether uvwasi's behavior is expected; any implementation change and regression coverage would need maintainer guidance.
Written by the indexing model from the issue text.
Description
It looks there is differences about handling symlinks between uvwasi and wasmtime.
Assuming #224 was merged and given the file path is /var/dir/file and sandbox root is /var/dir:
| Link Target \ Runtime | wasmtime | uvwasi | (memo) |
|---|---|---|---|
/var/dir/file |
NG | OK | wasmtime prohibits absolute paths without exception |
./file |
OK | OK | |
../file |
NG | NG | not in the sandbox root |
../dir/file |
NG | OK | wasmtime prohibits relative paths referencing a path that once deviates from the root of the sandbox |
I'd like to know whether this is expected behavior for uvwasi.
- Dominant language
- C
- Stars
- 272
- Forks
- 60
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodejs/uvwasi
-
path_filestat_get returns inval for empty pathsPossibly taken @dannyward630 claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 1/5 Under an hour Newbie friendliness 25/100
-
Difficulty 1/5 Under an hour Newbie friendliness 15/100
-
Difficulty 1/5 Under an hour Newbie friendliness 20/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
FujiNetWIFI/fujinet-lib#204 ·
Maintainers usually reply within 1 day
-
os:linux
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
mpv-player/mpv#18649 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
facebookincubator/muse-gadget-sdk#249 ·
Maintainers usually reply within 1 day
-
docs: nng_dial / nng_dialer_start can return NNG_ECONNSHUT and NNG_ECRYPTO, which are not documentedOpen
Difficulty 1/5 1-3 hours Newbie friendliness 89/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
micropython/micropython#19786 ·
Maintainers usually reply within 1 day