Disable guest WebAssembly by default; add an opt-in permission
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- rust, typescript, wasm
调研方向
首先，跟踪 CreateVmConfig 在 wire 上的传递过程，以及权限如何到达 NodeRuntime/secure-exec TypeScript 客户端和 Rust 客户端。查看 runtime-platform 文档和现有的默认拒绝权限模型。当 guest WebAssembly 默认禁用、opt-in scope 在两个客户端上都能正常工作，并且安全性依据和 npm 包的权衡取舍都已记录时，即视为完成。
由索引模型根据 Issue 内容生成。
描述
Summary
Make guest WebAssembly disabled by default, and add a permission scope users opt into to re-enable it (consistent with our deny-by-default permission posture).
Motivation
Today the guest WebAssembly API is always available in the V8 isolate (runtime-platform docs: "WebAssembly stays available on every tier"). There is currently no way to disable it (no expose_wasm / jitless flag plumbed through the runtime).
WebAssembly grants the guest no additional capability over JavaScript (both are isolate-confined, have no ambient authority, and route all I/O through the kernel), and the classic side-channel vector (Spectre via SharedArrayBuffer + high-resolution timers) is already mitigated by default by timingMitigation: "freeze" (removes SharedArrayBuffer, freezes timers).
The remaining, legitimate concern is V8 JIT/compiler attack surface: the WASM compiler is large and complex, and WASM JIT bugs have historically been used for in-isolate memory-corruption → sandbox escapes. For maximally-untrusted workloads, being able to remove that surface is valuable defense-in-depth. Since we are deny-by-default everywhere else, WASM should follow the same model.
Proposed design
- Add a permission scope, e.g.
permissions: { webAssembly: "allow" | "deny" }, deny by default. - When denied, the guest's
WebAssemblyglobal is unavailable (and ideally the isolate runs without the WASM compiler / jitless where feasible) so the JIT attack surface is actually removed, not just the global hidden. - Plumb through
CreateVmConfigon the wire and expose on both the TypeScript client (NodeRuntime/secure-exec) and the Rust client (per the wire/client-parity rule). - Update the
runtime-platformdocs: note WASM is off by default for hardening, how to opt in, and the security rationale (no extra capability; side-channels already mitigated; this reduces JIT attack surface).
Tradeoff to weigh during design
Some real npm packages ship WASM internally (certain crypto/compression/image/parsing libs). Deny-by-default will break those unless the user opts in, so the opt-in must be easy and clearly documented. (If default-off proves too disruptive in practice, the fallback is default-on with an easy opt-out, but the issue as filed requests default-off + opt-in.)
Notes
- Distinct from the WASI command runtime that runs
sh/coreutils (those are separate WASM binaries the sidecar runs); this is specifically the guest'sWebAssemblyglobal.
- 主要语言
- TypeScript
- 星标
- 1k
- 派生
- 54
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
rivet-dev/dynamic-apps 的其他 Issue
-
Build cache ignores maxResponseBytes, potentially reusing an outdated response limit可能已有人在做 @Utkarshpandey0001 于 17 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 78/100
rivet-dev/dynamic-apps#297 ·
-
难度 3/5 1-2 天 新手友好度 58/100
rivet-dev/dynamic-apps#280 · 2 条评论 ·
-
Make agentOS runtime classifier content-based (match Linux exec semantics), not extension-based可能已有人在做 @mittal-parth 于 22 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 48/100
rivet-dev/dynamic-apps#275 ·
-
难度 4/5 3-5 天 新手友好度 55/100
rivet-dev/dynamic-apps#272 ·
-
Treat the WASM/WASI build target as cfg(unix) so filesystem tools need no per-tool mode-bit patches未关闭
难度 5/5 一周以上 新手友好度 35/100
rivet-dev/dynamic-apps#271 ·
查看 rivet-dev/dynamic-apps 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 85/100
umbraco/Umbraco-CMS-MCP-Dev#512 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
wimpysworld/sidra#290 ·
维护者通常 1 天内回复
-
defuFn invokes function values for inherited default properties可能已有人在做 @xiehuanyi 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 85/100
-
feature request good first issue
难度 2/5 1-3 小时 新手友好度 85/100
TabularisDB/tabularis#853 ·
维护者通常 1 天内回复
-
难度 2/5 1 小时以内 新手友好度 85/100
capricorn86/happy-dom#2474 ·
维护者通常 2 天内回复