4 ms·
> Luckily, AssemblyScript provides a magic unchecked() annotation to indicate that we are taking responsibility for staying in-bounds. Isn't this a security ri
by f00zz 6y ago
> Luckily, AssemblyScript provides a magic unchecked() annotation to indicate that we are taking responsibility for staying in-bounds.
Isn't this a security risk?
- ludamad 6y agoNot if you control all the memory around it
- dj_mc_merlin 6y agoHow so? What are you going to hack by writing to out of bounds memory, your own browser?
- Ar-Curunir 6y agoEr, depending on how it’s implemented, you can use that to execute arbitrary code outside the browser sandbox
- RReverser 6y agoNo, that's never allowed - that's the strength of Wasm. Any unchecked helpers are for language-level semantic blocks within Wasm memory itself, not for leaving the sandbox. So worst case you might override and corrupt your own data.
- deleted 6y ago[deleted]
- TheCoelacanth 6y agoCould potentially be an XSS vulnerability. Imagine an HN-like page is written in this and uses unchecked in some code path for displaying user comments. I comment something that exploits that code. Then when you come along and view my comment. Now whatever my exploit does is running with your permissions instead of mine.
- vanderZwan 6y agoWouldn't you already have access to the full WASM memory object by the time you can write an exploit that affects a WASM module?
- TheCoelacanth 6y agoNo, the exploit would be in the comment text. You're exploiting a bug in the comment display code when it displays your comment to another user to do something that the comment display code isn't supposed to do. Much like exploiting a C program that handles untrusted text and doesn't bounds check it. You aren't supposed to be able to run any code at all, but a vulnerability lets you make the program do something it isn't supposed to. Some of the easiest exploits would be prevented since you probably can't overwrite code like you can (or used to be able to, a lot of platforms have added protection against this) in C, but some exploits are still possible just by overwriting other variables with values that the program doesn't expect.
- vanderZwan 6y agoIt definitely won't be able to break the WASM sandbox, so my guess is that AssemblyScript itself adds runtime checks of its own and that this is a hint that we don't need those.