4 ms·

lmao, only if you write something other than rust

by nynx 6y ago

fulafel 6y ago
There's a lot of unsafe usage in this codebase (https://github.com/ruffle-rs/ruffle/search?q=unsafe https://github.com/ruffle-rs/ruffle/search?q=unsafe returns 5 screenfuls) - though I don't know enough about Rust to tell how risky these are.
- emi2k01 6y ago
  Around 3.5 of those pages are unsafe uses for implementing the same trait for garbage collection. The implementations seem very simple and the documentation mentions invariants that are easy to hold so it should be easy to recognize an unsound implementation. I think that it should be possible to not use unsafe at all for some of those but I only skimmed over the code so I'm not sure. Most of the rest of unsafe uses are to skip rust checks that have already been asserted and for FFI which is unavoidable. There are only a few unsafe uses whose invariants are not well defined. I only gave it a quick look but I doubt they're risky. Even if an attacker manages to exploit ruffle, I wonder what could they do in a WASM sandbox in an isolated domain.
- kibwen 6y ago
  In this context any usage of `unsafe` in Rust is probably irrelevant to the safety of the resulting program, because AFAIK the WASM sandbox doesn't trust programs enough to actually allow them to do anything that could potentially violate memory safety.
  - fulafel 6y ago
    Yep, in a lot of use cases the wasm version probably is fine with the browser sandbox. But according to the readme this also targets the desktop. I would imagine the desktop mode is native code + wgpu, as there seems to be a wgpu directory under renderer/ . There are some scenarios when vulnerabilities in a wasm compiled program can be harmful too though. For example the web page embedding the emulated flash applet doesn't necessarily intend to give that app full access to that origin's context. For example it could exfiltrate some api keys or other security tokens of the logged in user of the containing page.

lmao, only if you write something other than rust

by nynx 6y ago

lmao, only if you write something other than rust

There's a lot of unsafe usage in this codebase (https://github.com/ruffle-rs/ruffle/search?q=unsafe https://github.com/ruffle-rs/ruffle/search?q=unsafe returns 5 screenfuls) - though I don't know enough about Rust to tell how risky these are.

emi2k01 6y ago
Around 3.5 of those pages are unsafe uses for implementing the same trait for garbage collection. The implementations seem very simple and the documentation mentions invariants that are easy to hold so it should be easy to recognize an unsound implementation. I think that it should be possible to not use unsafe at all for some of those but I only skimmed over the code so I'm not sure. Most of the rest of unsafe uses are to skip rust checks that have already been asserted and for FFI which is unavoidable. There are only a few unsafe uses whose invariants are not well defined. I only gave it a quick look but I doubt they're risky. Even if an attacker manages to exploit ruffle, I wonder what could they do in a WASM sandbox in an isolated domain.
kibwen 6y ago
In this context any usage of `unsafe` in Rust is probably irrelevant to the safety of the resulting program, because AFAIK the WASM sandbox doesn't trust programs enough to actually allow them to do anything that could potentially violate memory safety.
- fulafel 6y ago
  Yep, in a lot of use cases the wasm version probably is fine with the browser sandbox. But according to the readme this also targets the desktop. I would imagine the desktop mode is native code + wgpu, as there seems to be a wgpu directory under renderer/ . There are some scenarios when vulnerabilities in a wasm compiled program can be harmful too though. For example the web page embedding the emulated flash applet doesn't necessarily intend to give that app full access to that origin's context. For example it could exfiltrate some api keys or other security tokens of the logged in user of the containing page.