{"action":"created","issue":{"url":"https://api.github.com/repos/WebAssembly/design/issues/304","labels_url":"https://api.github.com/repos/WebAssembly/design/issues/304/labels{/name}","comments_url":"https://api.github.com/repos/WebAssembly/design/issues/304/comments","events_url":"https://api.github.com/repos/WebAssembly/design/issues/304/events","html_url":"https://github.com/WebAssembly/design/issues/304","id":101762465,"number":304,"title":"WASM application security considerations","user":{"login":"kg","id":198130,"avatar_url":"https://avatars.githubusercontent.com/u/198130?v=3","gravatar_id":"","url":"https://api.github.com/users/kg","html_url":"https://github.com/kg","followers_url":"https://api.github.com/users/kg/followers","following_url":"https://api.github.com/users/kg/following{/other_user}","gists_url":"https://api.github.com/users/kg/gists{/gist_id}","starred_url":"https://api.github.com/users/kg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kg/subscriptions","organizations_url":"https://api.github.com/users/kg/orgs","repos_url":"https://api.github.com/users/kg/repos","events_url":"https://api.github.com/users/kg/events{/privacy}","received_events_url":"https://api.github.com/users/kg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-18T22:24:03Z","updated_at":"2015-08-20T00:34:36Z","closed_at":null,"body":"#302 and a few other discussions have raised an issue we need to at least consider for the MVP: Application security.\r\n\r\nThe wasm sandbox provides security for the OS/browser hosting the wasm application, so we're all good there. Security for the application itself - the safety of its data, for example - is another concern. \r\n\r\nFor JavaScript/DOM applications this is currently addressed by the same-origin policy, data hiding (inside closures), etc. The approach used in JS+DOM is - to put it mildly, rather complicated.\r\n\r\nWhen thinking about JS->wasm and wasm->JS interop, along with scenarios where multiple wasm applications are loaded in a page (from different origins), we need to make sure nothing we spec allows for the integrity of a wasm module's heap to be significantly compromised. Otherwise, a couple years down the road we have some 'worst case' scenarios equivalent to someone being able to pull your whole email history out of the heap of your wasm email client.\r\n\r\nThis mostly comes up when addressing design considerations like how the wasm heap is exposed to JS (if at all), how data crosses the JS<->wasm boundary, how function pointers work, etc. The 'obvious' solution to some of these problems will have some significant security consequences."},"comment":{"url":"https://api.github.com/repos/WebAssembly/design/issues/comments/132836905","html_url":"https://github.com/WebAssembly/design/issues/304#issuecomment-132836905","issue_url":"https://api.github.com/repos/WebAssembly/design/issues/304","id":132836905,"user":{"login":"AndrewScheidecker","id":2691804,"avatar_url":"https://avatars.githubusercontent.com/u/2691804?v=3","gravatar_id":"","url":"https://api.github.com/users/AndrewScheidecker","html_url":"https://github.com/AndrewScheidecker","followers_url":"https://api.github.com/users/AndrewScheidecker/followers","following_url":"https://api.github.com/users/AndrewScheidecker/following{/other_user}","gists_url":"https://api.github.com/users/AndrewScheidecker/gists{/gist_id}","starred_url":"https://api.github.com/users/AndrewScheidecker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndrewScheidecker/subscriptions","organizations_url":"https://api.github.com/users/AndrewScheidecker/orgs","repos_url":"https://api.github.com/users/AndrewScheidecker/repos","events_url":"https://api.github.com/users/AndrewScheidecker/events{/privacy}","received_events_url":"https://api.github.com/users/AndrewScheidecker/received_events","type":"User","site_admin":false},"created_at":"2015-08-20T00:34:35Z","updated_at":"2015-08-20T00:34:35Z","body":"One way to deal with this would be to expose a JS implementation of map_shmem and/or shmem_create that returns a TypedArray. Then you can make JavaScript go through the proposed shared memory mapping mechanism (shmem_create&map_shmem). That provides opt-in sharing with pretty minimal constraints on the WebAssembly VM."}}