Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should not be able to create a symlink to absolute path #271

Closed
yagehu opened this issue Jun 12, 2024 · 0 comments · Fixed by #272
Closed

Should not be able to create a symlink to absolute path #271

yagehu opened this issue Jun 12, 2024 · 0 comments · Fixed by #272

Comments

@yagehu
Copy link
Contributor

yagehu commented Jun 12, 2024

WASI specifies that such an operation should fail. Node with uvwasi currently successfully creates the symlink. Other runtimes (Wasmtime, Wasmer, WasmEdge, Wazero, WAMR) successfully block this call.

fn main() {
    unsafe {
        let base_fd = 3;

        wasi::path_symlink("/a", base_fd, "a").unwrap();
    }
}
yagehu added a commit to yagehu/uvwasi that referenced this issue Jun 12, 2024
This commit adds an absolute path check to `path_symlink`. This behavior
is specified by [WASI][1].

[1]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md#symlinks

fixes nodejs#271

Signed-off-by: Yage Hu <me@huyage.dev>
yagehu added a commit to yagehu/uvwasi that referenced this issue Jun 12, 2024
This commit adds an absolute path check to `path_symlink`. This behavior
is specified by [WASI][1].

[1]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md#symlinks

fixes nodejs#271

Signed-off-by: Yage Hu <me@huyage.dev>
yagehu added a commit to yagehu/uvwasi that referenced this issue Jun 12, 2024
This commit adds an absolute path check to `path_symlink`. This behavior
is specified by [WASI][1].

[1]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md#symlinks

fixes nodejs#271

Signed-off-by: Yage Hu <me@huyage.dev>
mhdawson pushed a commit that referenced this issue Jul 3, 2024
This commit adds an absolute path check to `path_symlink`. This behavior
is specified by [WASI][1].

[1]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md#symlinks

fixes #271

Signed-off-by: Yage Hu <me@huyage.dev>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant