Skip to content

Commit ee647ab

Browse files
lum1n0uslum1n0us
committed
Add documentation regarding security issues and the status of Wasm proposals.
1 parent 932eb5d commit ee647ab

File tree

2 files changed

+100
-0
lines changed

2 files changed

+100
-0
lines changed

‎doc/security_need_to_know.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# About security issues
2+
3+
This document aims to explain the process of identifying a security issue and the steps for managing a security issue.
4+
5+
## identifying a security issue
6+
7+
It is commonly stated that a security issue is an issue that:
8+
- Exposes sensitive information to unauthorized parties.
9+
- Allows unauthorized modification of data or system state.
10+
- Affects the availability of the system or its services.
11+
- Permits unauthorized access to the system.
12+
- Enables users to perform actions they should not be able to.
13+
- Allows users to deny actions they have performed.
14+
15+
Given that WASI is a set of Capability-based APIs, all unauthorized actions are not supposed to happen. Most of the above security concerns can be alleviated. What remains for us is to ensure that Wasm modules ' execution is secure. In other words, do not compromise the sandbox. Unless it is explicitly disabled beforehand.
16+
17+
Thus, we share most of the criteria for judging security issues with [the Bytecode Alliance](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#definition).
18+
19+
>[!NOTE]
20+
> keep updating this document as the project evolves.
21+
22+
## managing a security issue
23+
24+
Before reporting an issue, particularly one related to crashing, consult [the cheat sheet](), *Report a security vulnerability* if it qualifies.
25+
26+
Upon receiving an issue, thoroughly review [the cheat sheet] to assess and *Report a security vulnerability* if the issue is indeed a security vulnerability .
27+
28+
Once a security issue is confirmed, please refer to [the runbook](https://github.com/bytecodealliance/rfcs/blob/main/accepted/vulnerability-response-runbook.md) for the subsequent steps to take.

‎doc/stability_wasm_proposals.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Wasm Proposals
2+
3+
This document is intended to describe the current status of WebAssembly proposals and WASI proposals in WAMR.
4+
5+
Only track proposals that are followed in the [WebAssembly proposals](https://github.com/WebAssembly/proposals) and [WASI proposals](https://github.com/WebAssembly/WASI/blob/main/Proposals.md).
6+
7+
Normally, the document tracks proposals that are in phase 4. However, if a proposal in an earlier phase receives support, it will be added to the list below.
8+
9+
The _status_ represents the configuration _product-mini/platforms/linux/CMakeLists.txt_. There may be minor differences between the top-level CMakeLists and platform-specific CMakeLists.
10+
11+
Users can turn those features on or off using compilation options. If a relevant compilation option is not available(`N/A`), it indicates that the feature is permanently enabled.
12+
13+
## On-by-default Wasm Proposals
14+
15+
| Proposal | Phase 4 | Compilation Option |
16+
| ------------------------------------- | ------- | -------------------------- |
17+
| Non-trapping float-to-int conversions | Yes | N/A |
18+
| Sign-extension operators | Yes | N/A |
19+
| Multi-value | Yes | N/A |
20+
| Reference Types | Yes | `WAMR_BUILD_REF_TYPES` |
21+
| Bulk memory operations | Yes | `WAMR_BUILD_BULK_MEMORY` |
22+
| Fixed-width SIMD[^1] | Yes | `WAMR_BUILD_SIMD` |
23+
| Extended Constant Expressions | Yes | N/A |
24+
| Typed Function References | Yes | `WAMR_BUILD_GC` |
25+
| Thread | Yes | `WAMR_BUILD_SHARED_MEMORY` |
26+
| Exception handling[^2] | Yes | `WAMR_BUILD_EXCE_HANDLING` |
27+
| WebAssembly C and C++ API | No | N/A |
28+
29+
[^1]: jit and aot only
30+
[^2]: interpreter only
31+
32+
## Off-by-default Wasm Proposals
33+
34+
| Proposal | Phase 4 | Compilation Option |
35+
| --------------------- | ------- | ------------------------- |
36+
| Tail call | Yes | `WAMR_BUILD_TAIL_CALL` |
37+
| Garbage collection | Yes | `WAMR_BUILD_GC` |
38+
| Multiple memories[^3] | Yes | `WAMR_BUILD_MULTI_MEMORY` |
39+
| Memory64 | Yes | `WAMR_BUILD_MEMORY64` |
40+
41+
[^3]: interpreter only
42+
43+
## Unimplemented Wasm Proposals
44+
45+
| Proposal | Phase 4 |
46+
| ------------------------------------------- | ------- |
47+
| Import/Export of Mutable Globals | Yes |
48+
| Relaxed SIMD | Yes |
49+
| Custom Annotation Syntax in the Text Format | Yes |
50+
| Branch Hinting | Yes |
51+
| JS String Builtins | Yes |
52+
53+
## On-by-default WASI Proposals
54+
55+
| Proposal | Phase 4 | Compilation Option |
56+
| -------- | ------- | ------------------ |
57+
58+
## Off-by-default WASI Proposals
59+
60+
| Proposal | Phase 4 | Compilation Option |
61+
| -------------------------- | ------- | ----------------------------- |
62+
| Machine Learning (wasi-nn) | No | `WAMR_BUILD_WASI_NN` |
63+
| Threads | No | `WAMR_BUILD_LIB_WASI_THREADS` |
64+
65+
## Unimplemented WASI Proposals
66+
67+
| Proposal | Phase 4 |
68+
| -------- | ------- |
69+
70+
## WAMR features
71+
72+
WAMR offers a variety of customizable features to create a highly efficient runtime. For more details, please refer to [build_wamr](./build_wamr.md).

0 commit comments

Comments
 (0)