src,pm: disable WASI when pm is enabled

Open RafaelGSS opened this issue 1 year ago • 1 comments

Following up https://hackerone.com/reports/2470213.

The permission model currently does not cover WASI by default, and that's expected. But, it seems that I failed to document it properly (A (brief) documentation effort was made on https://github.com/nodejs/node/pull/47782). I am creating a --allow-wasi flag to address this issue and potentially block WASI entirely.

May 23 '24 20:05 RafaelGSS

Review requested:

[ ] @nodejs/gyp
[ ] @nodejs/security-wg
[ ] @nodejs/wasi

May 23 '24 20:05 nodejs-github-bot

CI: https://ci.nodejs.org/job/node-test-pull-request/59393/

May 24 '24 18:05 nodejs-github-bot

CI: https://ci.nodejs.org/job/node-test-pull-request/59528/

May 29 '24 18:05 nodejs-github-bot

CI: https://ci.nodejs.org/job/node-test-pull-request/59546/

May 30 '24 17:05 nodejs-github-bot

Landed in 3ab0499d434078676261512a67897f4c2f433e43

Jun 01 '24 13:06 nodejs-github-bot