rules-webassembly

RISK (CWE-116 / CWE-94): compiling WebAssembly from user-supplied bytes allows an attacker to execute arbitrary code inside your origin's WASM sandbox — and from there reach any imported host function. FIX: only compile first-party, integrity-checked binaries. If you must run user code, evaluate it in an isolated Worker or a sandboxed iframe with its own origin that has no sensitive host-function imports.

RISK (CWE-78 / CWE-20): bridging eval, exec, child_process, or raw fs operations into WASM as host-function imports creates a code-execution escape hatch — any logic flaw or malicious payload in the module can call these functions with attacker-controlled arguments. FIX: expose only the minimal host surface the module needs (logging, typed data exchange). Never expose shell-execution or arbitrary file-write imports; use structured message-passing to the host instead.

RISK (CWE-319): fetching a .wasm file over http:// exposes the binary to in-transit MITM substitution — an attacker on the network can silently swap in a malicious module. FIX: host the .wasm on https:// and ensure the fetch URL starts with https://. For local dev use a local HTTPS devserver or a same-origin relative path.

RISK (CWE-494): WebAssembly.instantiate / instantiateStreaming from an http:// URL loads an unauthenticated binary — any on-path attacker can replace the module with arbitrary machine code that executes at near-native speed in your origin. FIX: always use https:// and add a subresource integrity (SRI) check: fetch the module with { integrity: 'sha384-...' } in the RequestInit, or validate the ArrayBuffer hash before passing it to instantiate().

RISK (CWE-400): WebAssembly.Memory without a maximum grows without bound until the tab crashes or is killed by the browser's OOM killer — a single crafted input can exhaust gigabytes of address space. FIX: always set { initial: N, maximum: M } where M is the largest buffer your workload realistically needs (e.g., maximum: 256 for a 16 MB cap). The Whisper model plugin pattern caps at 512 pages (32 MB audio buffer) before the 547 MB model is written to the emscripten virtual FS.

RISK (Spectre / CORS isolation): SharedArrayBuffer exposes a high-resolution timer via Atomics.wait that enables Spectre-style cache-timing attacks against the process address space. Browsers gate SharedArrayBuffer behind cross-origin isolation: the page MUST be served with Cross-Origin-Opener-Policy: same-origin AND Cross-Origin-Embedder-Policy: require-corp. FIX: add both COOP/COEP headers server-side, verify document.crossOriginIsolated === true at runtime before constructing the buffer, and document why multi-threaded WASM is required. Note: the SigmaShake voice-dictation plugin deliberately uses single-threaded WASM to avoid this requirement.

ADVISORY: every WebAssembly.instantiate() call is a module-load boundary. Confirm: (1) the source is a first-party or integrity-checked binary; (2) the importObject exposes only the minimum required host surface (no exec/fs/eval bridges); (3) Memory has a maximum; and (4) if multi-threaded, the page is cross-origin isolated. See the other wasm-* rules for individual checks.

RISK (CWE-494): WebAssembly.instantiate / instantiateStreaming without a subresource integrity check loads an unauthenticated binary — a compromised CDN or storage bucket can silently substitute a malicious module. FIX: pass { integrity: 'sha384-<base64>' } in the fetch RequestInit before piping to instantiateStreaming, or verify the ArrayBuffer SHA-256/SHA-384 hash before calling instantiate(). Keep the expected hash pinned in source control next to the fetch URL.

RISK (CWE-125 / CWE-787): reading or writing WebAssembly linear memory at an offset derived from untrusted input without a bounds check can read beyond the end of a valid region (info-leak) or write into adjacent allocations (heap corruption). FIX: always validate that offset + access_size <= memory.buffer.byteLength before every typed-array access. Centralise bounds validation in a helper (e.g., safeRead / safeWrite) and use it everywhere the wasm module passes back raw pointers.