4 ms·

What is the purpose of compiling this to web assembly? What web assembly runtimes are there where there is not already an easily accessible (substantially faste

What is the purpose of compiling this to web assembly? What web assembly runtimes are there where there is not already an easily accessible (substantially faster) js execution environment? I know wasmtime exists and is not tied to a js execution engine like basically every other web assembly implementation, but the uses of wasmtime are not restricted from dependencies like v8 or jsc. Usually web assembly is used for providing sandboxing something a js execution environment is already designed to provide, and is only used when the code that requires sandboxing is native code not javascript. It sounds like a good way to waste a lot of performance for some additional sandboxing, but I can't imagine why you would ever design a system that way if you could choose a different (already available and higher performance) sandbox.

simonw 10mo ago
I want to build features - both client- and server-side - where users can provide JavaScript code that I then execute safely. Just having a WebAssembly engine available isn't enough for this - something has to take that user-provided string of JavaScript and execute it within a safe sandbox. Generally that means you need a JavaScript interpreter that has itself been compiled to WebAssembly. I've experimented with QuickJS itself for that in the past - demo here: https://tools.simonwillison.net/quickjs https://tools.simonwillison.net/quickjs - but MicroQuickJS may be interesting as a smaller alternative. If there's a better option than that I'd love to hear about it!
- MobiusHorizons 10mo ago
  This is generally the purpose of JavaScript execution environments like v8 or jsc (or quickjs although I understand not trusting that as a sandbox to the same degree). They are specifically intended for executing untrusted scripts (eg web browsers). Web assembly’s sandboxing comes from js sandboxing, since it was originally a feature of the same programs for the same reasons. Wrapping one sandbox in another is what I’m surprised by.
  - simonw 10mo ago
    Running v8 itself as a sandbox is non-trivial, at least embedded in a Python or Node.js or similar application. The web is littered with libraries that half do that and then have a note in the README that says "do not rely on this as a secure sandbox".
    - MobiusHorizons 10mo ago
      Is it though? I have not personally used these libraries, but a cursory google search reveals several options: - cloudflare/STPyV8: [0] From cloudflare, intended for executing untrusted code. - Pythonmonkey: [1] Embeds spidermonkey. Not clearly security focused, but sandboxing untrusted code is literally the point of browser js engines. It's a little less clear how you would do this from node, but the v8 embedding instructions should work https://v8.dev/docs/embed https://v8.dev/docs/embed even if nodejs is already a copy of v8. [0]: https://github.com/cloudflare/stpyv8 https://github.com/cloudflare/stpyv8 [1]: https://docs.pythonmonkey.io https://docs.pythonmonkey.io
      - simonw 10mo ago
        ... whoa, I don't know how I missed it but I hadn't seen STPyV8 before. I'd seen PyV8 and ruled it out as very unmaintained. One of my requirements for a sandbox is that it needs to me maintained by a team of professionals who are running a multi-million dollar business on it. Cloudflare certainly count! I wonder what they use STPyV8 for themselves? ... on closer inspection it doesn't seem to have the feature I care most about: the ability to constrain memory usage (see comment here https://github.com/cloudflare/stpyv8/blob/57e881c7fbe178c598262cb5da53d2bce1b41684/src/Engine.cpp#L120C14-L120C69 https://github.com/cloudflare/stpyv8/blob/57e881c7fbe178c598...) - and there's no built-in support for time limits either, you have to cancel tasks from a separate thread: https://github.com/cloudflare/stpyv8/issues/112 https://github.com/cloudflare/stpyv8/issues/112 PythonMonkey looks promising too: the documentation says "MVP as of September 2024" so clearly it's intended to be stable for production use at this point.
        10mo ago
- santadays 10mo ago
  GraalVM supports running javascript in a sandbox with a bunch of convenient options for running untrusted code. https://www.graalvm.org/latest/security-guide/sandboxing/ https://www.graalvm.org/latest/security-guide/sandboxing/
  - simonw 10mo ago
    Oh that looks neat! It appears to have the memory limits I want (engine.MaxIsolateMemory) and a robust CPU limit: sandbox.MaxCPUTime One catch: the sandboxing feature isn't in the "community edition", so only available under the non-open-source (but still sometimes free, I think?) Oracle GraalVM.
kettlecorn 10mo ago
As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation. In a browser environment it's much easier to sandbox Wasm successfully than to sandbox JS.
- MobiusHorizons 10mo ago
  That’s very interesting! Have they documented the reasoning for that approach? I would have expected iframes to be both simpler and faster sandboxing mechanism especially in compute bound cases. Maybe the communication overhead is too high in their workload? EDIT: found this from your other comment: https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/ they do not address any alternatives considered.
deleted 10mo ago
[deleted]

simonw 10mo ago

I want to build features - both client- and server-side - where users can provide JavaScript code that I then execute safely. Just having a WebAssembly engine available isn't enough for this - something has to take that user-provided string of JavaScript and execute it within a safe sandbox. Generally that means you need a JavaScript interpreter that has itself been compiled to WebAssembly. I've experimented with QuickJS itself for that in the past - demo here: https://tools.simonwillison.net/quickjs https://tools.simonwillison.net/quickjs - but MicroQuickJS may be interesting as a smaller alternative. If there's a better option than that I'd love to hear about it!

MobiusHorizons 10mo ago
This is generally the purpose of JavaScript execution environments like v8 or jsc (or quickjs although I understand not trusting that as a sandbox to the same degree). They are specifically intended for executing untrusted scripts (eg web browsers). Web assembly’s sandboxing comes from js sandboxing, since it was originally a feature of the same programs for the same reasons. Wrapping one sandbox in another is what I’m surprised by.
- simonw 10mo ago
  Running v8 itself as a sandbox is non-trivial, at least embedded in a Python or Node.js or similar application. The web is littered with libraries that half do that and then have a note in the README that says "do not rely on this as a secure sandbox".
  - MobiusHorizons 10mo ago
    Is it though? I have not personally used these libraries, but a cursory google search reveals several options: - cloudflare/STPyV8: [0] From cloudflare, intended for executing untrusted code. - Pythonmonkey: [1] Embeds spidermonkey. Not clearly security focused, but sandboxing untrusted code is literally the point of browser js engines. It's a little less clear how you would do this from node, but the v8 embedding instructions should work https://v8.dev/docs/embed https://v8.dev/docs/embed even if nodejs is already a copy of v8. [0]: https://github.com/cloudflare/stpyv8 https://github.com/cloudflare/stpyv8 [1]: https://docs.pythonmonkey.io https://docs.pythonmonkey.io
    - simonw 10mo ago
      ... whoa, I don't know how I missed it but I hadn't seen STPyV8 before. I'd seen PyV8 and ruled it out as very unmaintained. One of my requirements for a sandbox is that it needs to me maintained by a team of professionals who are running a multi-million dollar business on it. Cloudflare certainly count! I wonder what they use STPyV8 for themselves? ... on closer inspection it doesn't seem to have the feature I care most about: the ability to constrain memory usage (see comment here https://github.com/cloudflare/stpyv8/blob/57e881c7fbe178c598262cb5da53d2bce1b41684/src/Engine.cpp#L120C14-L120C69 https://github.com/cloudflare/stpyv8/blob/57e881c7fbe178c598...) - and there's no built-in support for time limits either, you have to cancel tasks from a separate thread: https://github.com/cloudflare/stpyv8/issues/112 https://github.com/cloudflare/stpyv8/issues/112 PythonMonkey looks promising too: the documentation says "MVP as of September 2024" so clearly it's intended to be stable for production use at this point.
      - 10mo ago
santadays 10mo ago
GraalVM supports running javascript in a sandbox with a bunch of convenient options for running untrusted code. https://www.graalvm.org/latest/security-guide/sandboxing/ https://www.graalvm.org/latest/security-guide/sandboxing/
- simonw 10mo ago
  Oh that looks neat! It appears to have the memory limits I want (engine.MaxIsolateMemory) and a robust CPU limit: sandbox.MaxCPUTime One catch: the sandboxing feature isn't in the "community edition", so only available under the non-open-source (but still sometimes free, I think?) Oracle GraalVM.

kettlecorn 10mo ago

As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation. In a browser environment it's much easier to sandbox Wasm successfully than to sandbox JS.

MobiusHorizons 10mo ago
That’s very interesting! Have they documented the reasoning for that approach? I would have expected iframes to be both simpler and faster sandboxing mechanism especially in compute bound cases. Maybe the communication overhead is too high in their workload? EDIT: found this from your other comment: https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/ they do not address any alternatives considered.

deleted 10mo ago

[deleted]