Replies: 1 comment 4 replies
-
|
Will try to answer every question individually.
Correct, and this is by design. The only host APIs that are always exposed to the engine are the allocator, the filesystem and stdio. Furthermore, we're also investigating ways to completely isolate the engine from
Safe from a security standpoint? Yes. Any method that allows manipulating the host without passing through an exposed API is considered a bug from us. However, from an execution standpoint, the engine can still hang indefinitely or allocate too much memory and crash the main process, but we're actively working on ways to limit the execution space-time of an active context (#2350, #3442).
We're a bit more pragmatic with our policy about |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot for your response!
Just to clarify, when you say the filesystem is exposed to the engine, that doesn't mean the filesystem is exposed to scripts inside the engine, right? I suppose the engine needs fs access to import scripts from it? What if I use a custom module loader? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, the filesystem is only exposed for the embedder. No JS APIs can access the filesystem without exposing a native function first. |
Beta Was this translation helpful? Give feedback.
-
Yeah, those are the only APIs that use the fs. If you only parse scripts from strings instead of files and you implement a custom module loader that cannot access the fs, you would essentially isolate the engine from the host filesystem. |
Beta Was this translation helpful? Give feedback.
-
|
Perfect! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I noticed that Boa is separating ECMAScript functionality from runtime functionality, by putting the latter in a separate crate. This is great. Unless I'm overlooking something, this means JS scripts running inside Boa cannot perform any network or filesystem activity unless explicitly allowed through exposed runtime functions, right?
Does this also mean that it is safe to use Boa as a sandbox for JS scripts? I understand if you cannot make promises of this matter, but is it the intention of the project that scripts running without additional runtime functions should be always safe to run from the perspective of the host? It might be helpful if the documentation provides some kind of statement on your stance with regards to security.
It might also be good to clarify your regards the use of
unsafehere. I found 92 instances ofunsafein your code (excluding tests and examples). At first glance, most are easy to verify as being safe, but I wonder what your policy is.Thanks!
Beta Was this translation helpful? Give feedback.
All reactions