3 ms·

Why?

• Animats 11y ago
  Yes, it's supposed to be sandboxed. But "programs which invoke undefined behavior at the source language level may be compiled into WebAssembly programs which do anything else, including corrupting the contents of the application heap, calling APIs with arbitrary parameters, hanging, trapping, or consuming arbitrary amounts of resources (within the limits)." [1] So now it's possible to hammer on the entire JavaScript API with invalid parameters. How long before someone finds a hole? [1] https://github.com/WebAssembly/design/issues/205 https://github.com/WebAssembly/design/issues/205
  • mccr8 11y ago
    That quote is talking about (untrusted) compilers that translate from C/C++ with undefined behavior to WebAssembly programs. The latter would still have a defined behavior. People already "hammer on the entire JavaScript API with invalid parameters". That's what fuzzing is, and yes, it does find implementation errors which can lead to security problems.